BlockThreat - Week 29, 2023
AlphaPo | Conic | BNO | Bitfinex | Github | Anubis
More than $64,000,000 were stolen this week. The majority of losses came from the hot wallet compromise of AlphaPo, a cryptocurrency payment processor by a North Korean actor. The attack comes among increasing news of infrastructure and supply chain compromises like the Jump Cloud compromise, Github projects to target crypto developers, cloud services along with more direct spear phishing.
Things are not much better in the DeFi land. Conic was hit multiple time in a single day losing $3.6m with Read-only Reentrancy and Price Oracle Manipulation exploits while multiple projects on BSC reused the same vulnerable airdrop randomness generator and paid $230k for the mistake. The rest of the compromises continue the trend of Price Oracle and Reward Manipulation exploits making weekly reports blur together. Auditors, developers please focus on these two attack vectors in any part of your code that touches price data or calculates user payoffs.
To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.
On the brighter side, last week featured a number of fantastic cryptocurrency conferences. DeFi Security Summit 2023 featured an extraordinary collection of talks on all facets of the blockchain security space from auditing and secure development to monitoring and incident response. I would recommend checking out my talk on The State of DeFi Security which features stats collected over many months of writing the newsletter including this year’s Top 10 DeFi Attack Vectors, Incident Response timelines, recommendations on how to secure our ecosystem, and a message that I hope will inspire you all to continue fighting the good fight.
And with that let’s dive into the news!
News
Justice Department Revamps Crypto Enforcement Team. Double the number of prosecutors, a new director, and a new permanent place inside DoJ.
Stolen Microsoft key offered widespread access to Microsoft cloud services.
TRM Finds Mounting Evidence of Crypto Use by ISIS and its Supporters in Asia. The chain of choice for bad actors is Tron!
Binance money processor Advcash looks like a Russian laundering op.
Crypto whales targeted in wave of home invasions near Vancouver.
Scams
Reports of ongoing ERC-1155 Sleepdrop scam by Forta.
Rug pull losses reached $219m in H1 2023 according to PeckShield.
Analysis of the $60M Anubis DAO rug pull by ZachXBT.
Shell Protocol, PleasrDAO, Hayden Adams’ Twitter account hijacked to advertise a phishing site.
Malware
Contests
Secureum A-MAZE-X CTF 2023 Solutions by Patrick.
Media
DeFi Security Summit 2023. Hard to pick a favorite talk because they were all excellent. I would recommend going through the playlist one by one. However, I would love to shill a couple of talks that myself and my colleague had a pleasure of delivering during the conference:
ETH CC 6 - 2023 featured a dedicated security track with 60 talks. There are too many to list here, but you can find individual talks in a respective Livestream Youtube link. Here are just a few that I had a chance to watch:
ETH Belgrade
Reducing smart contract hacks Panel w/ neburo, NPalinkasevic, engn33r.
2 reasons why your project is getting hacked by Oliver Hörr (Hats Finance).
Adoption of Slither for enhancing smart contracts security by Nikita Kirillov (Pessimistic Security).
How we can front run crypto exploits before they happen by Evgeny Marchenko (Pessimistic Security).
From bytecode to bugs by Sifis Lagouvardos (Dedaub)
How to get the most out of your smart contract audit by Tomas Bayer ( Ackee Blockchain Security).
Honeypots - Hacker traps on the blockchain by Noah Jelich (Hacken).
Research
The Top 10 Most Common Vulnerabilities In Web3 by Immunefi.
How To Reproduce A Simple MEV Attack by Immunefi.
Your Sandwich Is My Lunch: How To Drain MEV Contracts V2 by pepsipu (Zellic).
Threshold Encrypted Mempools: Limitations and Considerations.
Crypto bridges sins exposed. Exploiting weak spots of multi-chain protocols by deliriusz.
Fuzzing on-chain contracts with Echidna by Guillermo Larregay and Elvis Skozdopolj (Trail of Bits).
A Comprehensive Guide to Arbitrum and its Security Features by Rob Behnke (Halborn).
Tools
MetaSleuth Monitor - monitor a list of addresses for real-time funds movements.
Transaction Allowlist - a set of supported transaction structures and conditions which will be allowed by the protocol.
Semgrep rules for smart contracts by Decurity.
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.