BlockThreat - Week 33, 2019

Beaxy | PlusToken | Dash | EOS

The last few weeks without an exchange hack have unfortunately been interrupted by Beaxy which fell victim to a well known XRP exploit. A number of excellent research articles came out this week ranging from CipherTrace’s Q2 report on the whole blocksec industry to more specific papers on vulnerabilities in EOS, tracking Ethereum honeypots, PlusToken scam details, and many others. Dash fell victim to an apparent attack which resulted in masternodes crashing and transaction getting dropped.

Hacks

• Months-Old Exchange Beaxy Targeted With XRP Partial Payment Exploit, Vows to Rollback Trades - a well known and frequently abused feature in the XRP protocol was used to steal funds from Beaxy exchange. In this attack, the partial payments feature is abused to craft a transaction which only appears to have a large amount of XRP. It appears that Beaxy failed to check for the partial payments flag and credited attacker’s account with non-existent funds. A similar exploit was used to steal 7 millio…