BlockThreat - Week 21, 2024
BlockThreat - Week 21, 2024
Gala | Normie | TonUp | Yon | Relevant
Greetings!
Another week with massive losses. More than $20M were stolen across 4 incidents. The top two compromises have interesting stores which we should discuss, but first a quick note from our sponsor Cyfrin!
Cyfrin is dedicated to helping scale smart contract security. Protocols looking for a private audit should reach out, but additionally, the team works on tools and platforms to scale security throughout the industry.
Cyfrin Updraft has the most watched smart contract development and security curriculum on earth. Cyfrin CodeHawks is the competitive audit platform for web3, for everyone from the started security researchers to the top bug hunting masters. Solodit is the audit report aggregator to help you learn the top attack vectors being reported today. Aderyn is the open-sourced rust-based static analyzer to help automatically detect bugs in your solidity codebase.
Gala lost $21M after a private key theft was used to mint 2B tokens. As pointed out by Tay, the project has a long history of theft and suspicious mints oddly reminiscent of the current incident. It sounds like a case of insider threat. How else could we explain such a quick identification of the culprit which led to the full return of funds in just one day?
Normie suffered from a weakness in identification of the team wallet which grants special privileges. The smart contract simply checked if sender’s address has the same amount of tokens as the team wallet address!
function _get_premarket_user(address _address, uint256 amount) internal {
premarket_user[_address] = !premarket_user[_address]
? (amount == balanceOf(teamWalletAddress))
: premarket_user[_address];
}The attacker took advantage of this to manipulate token supply and value to make $880K profit. What’s wilder are the familiar ego filled demands to founders trying to negotiate a return bounty from their X account :
@CaesarsCalls must take live recording of him stepping on a scale and showing us his true weight. Do what is right for the people fatso
And again on-chain:
To be clear: no funds will be returned until a new token has been launched and the dev wallet funds have been irrevocably committed to backing it. The dev wallet made significantly more than I did during this exploit, and I have no other way to ensure that those funds are used appropriately.
If this is not our Prisma or KyberSwap attacker then someone new really trying to emulate their thirst for public attention.
In other news, TonUP exploit marks the first publicly known hack on the TON chain with a staking contract exploit which was taken advantage by a number of accounts.
The premium version of the newsletter contains detail information on the incidents above as well as Yon, TonUP, and a failed governance exploit on Relevant.
To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.
Oh and be sure to check out fantastic videos with folks like Mudit Gupta, Isaac Patka, and Johnny Time in the Media section. Now let’s dive into the news!
News
Binance exec collapses in Nigerian court as health worsens in prison. In the latest ruling, Nigerian court decided Tigran should stand trial on behalf of the entire exchange. Binance is just watching the trial from afar while calling out corruption in the government neither of which is helping Tigran! US government doesn’t seem to be involved either while their citizen, former colleague, and someone with many contributions to the space is literally rotting in jail.
Crime
He Trained Cops to Fight Crypto Crime and Allegedly Ran a $100M Dark-Web Drug Market. Rui-Siang Lin aka “Pharoh” was arrested for running the ‘Incognito Market', one of the largest drug markets, after his proceeds were traced to a KYC-ed exchange account.
Malaysian Authorities Bust Syndicate Accused of Laundering Fraud Proceeds via Cryptocurrency.
British-Chinese Money Launder Sentenced to 6 Years in Prison For Role in $6B Fraud. This concludes the saga of Jian Wen’s involved in a $1.8B investment scam in China.
Hong Kong Police Arrest Three in ‘Hell Money’ Cryptocurrency Scam.
Policy
Phishing
Inferno Drainer resumes operations, claims $250 million stolen from crypto users.
Danger as wave of crypto influencers and celeb X accounts are hacked.
Scam you signed yourself by Mikko Ohtamaa. A thread on design decisions that enabled a plethora of approval scams and their variants.
How To Avoid MetaMask Infinite Approval Exploits by Charles Wang.
Game and streaming service malware scams are on the rise.
Scam as a service: Pink Drainer by BlockOSINT.
Scams
Coinbase, Meta, Ripple and others form ‘coalition’ to combat tech scams.
Hacker Breaches Scam Call Center, Warns Victims They've Been Scammed.
Malware
Media
Blockchain Security Series Episode 7: Mudit Gupta by Pablo Sabbatella.
Smart Contract Warrooms with @isaacpatka by PatrickAlphaC.
The Web3 Security Tool That CHANGES THE GAME - Glider Tutorial by Johnny Time.
Research
Are Inverse TWAP Prices Inaccurate? by engn33r.
What's the worst case of insider threat incidents you have seen? a fascinating thread on Reddit.
Taking down Cosmos chains thread by Jacob Gadikian.
DeFiTail: DeFi Protocol Inspection through Cross-Contract Execution Analysis.
Tools
Security Alliance - Drill Template - the tools that the SEAL Chaos Team uses to coordinate drills with protocol teams.
c4-table - A utility to track C4 contest submissions by carrotsmuggler.
Kontrol adds Foundry cheatcode support for formal verification.
Simbolik: Solidity Debugger VS Code plugin by Runtime Verification.
GoAlert - Open source on-call scheduling, automated escalations, and notifications so you never miss a critical alert.
Eth95.exe - An Instant UI for Smart Contracts.
Web3 Message Signing and Verification by Neptune Mutual.
EVM Diff adds cross-chain comparison.
Ape-AWS plugin enables AWS secrets access.
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.
Premium Content
Keep reading with a 7-day free trial
Subscribe to Blockchain Threat Intelligence to keep reading this post and get 7 days of free access to the full post archives.