​​According to Chengdu Chain Security [Beosin-Eagle Eye] security public opinion monitoring data shows: May 2021, according to incomplete statistics, the typical security of the entire blockchain ecosystem There were over 32 incidents, and the overall security risk rating was [High]. This month, although typical security incidents in other areas have eased, [DeFi] has become a “severe disaster zone” where typical security incidents frequently occur, requiring high vigilance; Binance Smart Chain (BSC) bears the brunt of the lightning loan attack by hackers The “main battlefield”.

Many BSC on-chain projects concentrated on “thunderstorms” in May, which the industry called “Black May”, and this is also the month with the highest frequency of attacks and the greatest loss in the history of DeFi. According to preliminary statistics, the economic loss caused was approximately US$300 million. The frequent occurrence of typical security incidents has also directly caused a variety of virtual asset currency price flash crashes. This May is an unprecedented “gray” month for investors, project parties, and the entire DeFi ecosystem.

The following are the details of this month’s security monthly report.

On the exchange side, a total of “1” typical security incidents occurred

01

The Hotbit exchange was attacked by an attacker, causing some basic services to be paralyzed. The Hotbit team will shut down all services for more than 7 days for inspection and recovery.

In terms of DeFi, a total of “14” typical security incidents occurred

01

On May 2, the DeFi project Spartan suffered a lightning loan attack, resulting in a loss of 30 million US dollars.

02

On May 7, ValueDeFi was attacked by hackers, and some of IRONFinance’s pools and products were attacked, resulting in possible exhaustion of STEELLP tokens.

03

DeFi revenue aggregator RariCapital was hacked, resulting in the loss of ETH worth more than $14.71 million.

04

The DeFi protocol xToken suffered a lightning loan attack, resulting in a loss of 24.5 million US dollars.

05

On May 16, bEarn Fi was attacked, resulting in a loss of nearly 11 million U.S. dollars.

06

On May 19, VENUS, BSC’s largest lending platform, had a large-amount liquidation. At present, more than 100 million US dollars of bad debts have been caused to the Venus platform.

07

On May 20, PancakeBunny, a DeFi revenue aggregator, was attacked by a lightning loan, and lost approximately US$45 million in WBNB and BUNNY.

08

FinNexus, an on-chain option agreement, is suspected of being attacked. As a result, hackers minted 323 million FNX on Ethereum through a certain address, worth 6 million U.S. dollars, and minted 60 million FNX on BSC, worth 1.6 million U.S. dollars.

See also  The $700 Million Wallet Crack: Bitcoin's 7th Largest Address Is Under Constant Attack - Bitcoin News

09

Bogged Finance officially stated that hackers carried out a flash loan attack on BOG token contracts, and transaction fees are currently disabled.

10

AutoSharkFinance was attacked by a lightning loan, and the price of the currency experienced a flash crash, with a drop of over 99% at one time.

11

Merlin was suspected of being attacked. It is reported that the project party seems to have temporarily suspended the minting of MERL tokens.

12

BurgerSwap is suspected of being attacked by a flash loan, and about $3.3 million of Burger was stolen.

13

On May 28th, JulSwap was attacked by a flash loan, and $JULB dropped by more than 95% in a short time.

14

On May 30, Belt Finance, an AMM protocol that combines multi-strategy revenue optimization on the BSC chain, was attacked by lightning loans.

数据:5月发生典型安全事件超32起,创DeFi历史损失之最

Beosin commented:

Projects on the BSC chain frequently “thunderstorms” in May and suffered heavy losses. This is enough to sound the alarm for BSC, DeFi, and even the entire blockchain ecology. By reviewing the commonalities of various typical security incidents, it is not difficult to find that the “flash loan attack” is the most important attack method adopted by hackers; and the amount of attack is generally large, and the losses of at least 6 projects have exceeded 10 million U.S. dollars. .

 

Here, the Chengdu Beosin·security team solemnly appeals that the follow-up DeFi project parties need to focus on preventing attacks related to “lightning loans”. As far as the DeFi project side is concerned, security auditing, security protection, and security reinforcement must not be ignored; when necessary, the power of third-party security companies can be linked to establish a set of comprehensive and professional risk control measures.

In terms of fraud/encryption scams, a total of “7” typical security incidents occurred

01

The GEC eco-coin has been driven and investigated by local governments many times. After the sharp drop in the price of the currency, it was once again exposed that it was suspected of being involved in pyramid schemes.

02

The fraud team defrauded $100,000 of virtual assets at SNL (Saturday Night Live) activities.

03

Someone posing as a member of the Coingecko team deceived the crypto project party, claiming to pay to list the tokens on the Coingecko platform.

See also  Litecoin, Stellar’s Lumen, and Tron’s TRX – Daily Analysis – September 15th, 2020 - Yahoo Finance

04

OnePlus co-founder Carl Pei’s Twitter account was hacked and used to promote crypto scams.

05

The official YouTube account of the Spanish Civil Guard has been under a suspected spear phishing attack and has been taken over by XRP scammers. The name of the account has been changed to “Ripple-XRP Foundation” and all content has been deleted.

06

The U.S. Office of the Comptroller of the Currency (OCC) issued a warning on recent encrypted fraudulent e-mails that it had not sent such messages or held any funds for personal gain.

07

DeFi100, a decentralized financial protocol based on BSC, was revealed to be a scam. The operator had already defrauded investors’ money and ran away.

数据:5月发生典型安全事件超32起,创DeFi历史损失之最

Beosin commented:

This month, although the [DeFi aspect] security situation is severe, the security threats from [scams/encryption scams] cannot be underestimated. Chengdu Beosin·Seven Star Laboratory has noticed that there have been a number of various fund projects under the banner of “DeFi” on the market recently, which are actually MLM scams. As an investor, remember to keep your eyes open and beware of MLM scams under the banner of “DeFi”!

In terms of ransomware/mining Trojans, a total of “3” typical security incidents occurred

01

Internet security software company Trend Micro has discovered a new type of malware called “Panda.” Researchers say that encrypted wallets, like bank accounts, have become targets of online theft.

02

Colonial Pipeline paid hackers a ransom of nearly $5 million last Friday, and previous reports stated that the company did not intend to pay hackers a ransom fee to help the U.S. pipeline resume operations.

03

The New Zealand Waikato Ministry of Health confirmed that the ransomware used in the previous cyber attack was “Zeppelin”, and the Minister of Health does not deny this.

In other respects, a total of “7” typical security incidents occurred

01

The Mask Network’s ITO contract was attacked by a robot, and the official has put the address on the blacklist.

02

On May 6, Hpool officially stated that the front end of the official website was attacked by DDOS and that it could not be accessed normally for the time being, but the mining service was not affected.

03

FeiLabs, the development team of FeiProtocol, discovered and disclosed a contract vulnerability and immediately suspended the contract. At present, the vulnerability has not been exploited and will not affect any users.

See also  Binance Security Report Sheds Light On Crypto Scams - Cointelegraph

04

The National Security Council of Kyrgyzstan (GKNB) cracked down on illegal mining operations in the capital Bishkek and Chuy region, raided and seized 2,000 illegal virtual asset mining equipment.

05

British police raided a warehouse near Birmingham and found that it was a fairly large Bitcoin mine. The Bitcoin mining machine is driven by electricity illegally separated from the main power source, and the equipment has been seized by the police.

06

A California man admitted to operating an unlicensed remittance business, money laundering and failing to maintain an effective anti-money laundering program, and was confiscated by the United States of Bitcoin (18.4 pieces) and Ethereum (222.5 pieces) worth approximately $1.25 million.

07

The core developers of Ethereum discovered a major vulnerability in EIP-1559. At present, the developers have added four checks to EIP-1559 and fixed the vulnerability.

数据:5月发生典型安全事件超32起,创DeFi历史损失之最

In view of the current security situation of the blockchain ecology, “Chengdu Lianan” summarizes here:

 

On the whole, typical security incidents in May increased significantly compared with April. The total number of incidents exceeded the “30” mark, and the overall security risk rose sharply from [low] to [high]. Especially in [DeFi], a series of hacking attacks, frequent security incidents, and financial losses of more than 300 million US dollars have undoubtedly caused a catastrophic blow to the security order of the entire DeFi ecosystem.

Under the severe situation, the Beosin security team noticed that after Pancakebunny was attacked by lightning loans, imitation disks such as Merlin and AutoSharkFinance on its BSC chain have also “fallen”. This is enough to show that the FORK project is not correct. The original project has an in-depth understanding, and new security risks have been introduced in the process of updating the code.

As an innovative financial model, how to find a balance between “innovation” and “safety” and achieve balance and parallelization of DeFi requires deep reflection by the majority of DeFi project developers. Here, we recommend that the majority of project parties remember to do a good job of relevant safety protection construction, and carry out real-time monitoring of abnormal operations, and immediately find out and solve it immediately! As a user, you should also enhance your own safety awareness, guard against safety risks, and avoid economic losses.

Nodesblock