BlockThreat - Week 23, 2019

Komodo | Gatehub | BlackSquid | VeriSol

This week started out with two major hacks targeting Komodo’s Agama wallet through a supply chain attack and the largest XRP theft by far (25 million XRP) from Gatehub.net. There was also an increase in the variety of cryptocurrency related malware, ranging from classic ransomware to increasingly more sophisticated cryptominers and private key harvesters. Microsoft continues to invest in the blockchain industry by adopting Boogie verification framework to Solidity in a tool called VeriSol.

Hacks:

• Plot to steal cryptocurrency foiled by the npm security team - a malicious node.js package electron-native-notify found its way into Komodo’s Agama Wallet designed to steal users’ seed phrases and upload them to a public server. The Komodo team responded by collecting stolen seed phrases on the public server and sending approximately 8 Million KMD and 96 BTC to a secure wallet controlled by Komodo. The attacker has spent months making a useful module and getting it into the supply chain before …