Autor Cointelegraph By Gareth Jenkinson

Curve Finance exploit: Experts dissect what went wrong

Decentralized finance protocols continue to be targeted by hackers, with Curve Finance becoming the latest platform to be compromised after a domain name system (DNS) hijacking incident.The automated market maker warned users not to use the front end of its website on Tuesday after the incident was flagged online by a number of members of the wider cryptocurrency community.While the exact attack mechanism is still under investigation, the consensus is that attackers managed to clone the Curve Finance website and rerouted the DNS server to the fake page. Users who attempted to make use of the platform then had their funds drained to a pool operated by the attackers.Curve Finance managed to remedy the situation in a timely fashion, but attackers still managed to siphon what was originally estimated to be $537,000 worth of USD Coin (USDC) in the time it took to revert the hijacked domain. The platform believes its DNS server provider Iwantmyname was hacked, which allowed the subsequent events to unfold.Cointelegraph reached out to blockchain analytics firm Elliptic to dissect how attackers managed to dupe unsuspecting Curve users. The team confirmed that a hacker had compromised Curve’s DNS, which led to malicious transactions being signed.Related: Cross chains, beware: deBridge flags attempted phishing attack, suspects Lazarus GroupElliptic estimates that 605,000 USDC and 6,500 Dai was stolen before Curve found and reverted the vulnerability. Utilizing its blockchain analytics tools, Elliptic then traced the stolen funds to a number of different exchanges, wallets and mixers.The stolen funds were immediately converted to Ether (ETH) to avoid a potential USDC freeze, amounting to 363 ETH worth $615,000.Interestingly, 27.7 ETH was laundered through the now United States Office of Foreign Assets Control-sanctioned Tornado Cash. 292 ETH was sent to the FixedFloat exchange and coin swap service. The platform managed to freeze 112 ETH and confirmed the movement of funds, according to an Elliptic spokesperson:“We have been in contact with the exchange, which confirmed a further three addresses that the hacker withdrew funds into from the exchange (these were completed orders that FixedFloat were not able to freeze in time). These include 1 BTC address, 1 BSC Address and 1 LTC address.”Elliptic is now monitoring these flagged addresses in addition to the original Ethereum-based addresses. A further 20 ETH was sent to a Binance hot wallet, and another 23 ETH was moved to an unknown exchange hot wallet. Elliptic also cautioned the wider ecosystem of further incidents of this nature after identifying a listing on a darknet forum claiming to sell “fake landing pages” for hackers of compromised websites. It is unclear whether this listing, which was discovered just a day before the Curve Finance DNS hijacking incident, was directly related, but Elliptic noted it highlights the methodologies used in these types of hacks.

Čítaj viac

1inch plugs into Klaytn as Asia continues to climb aboard

South Korea’s most popular metaverse blockchain Klaytn is set to benefit from deeper liquidity and improved token swaps through a new partnership with decentralized finance (DeFi) protocol 1inch Network.Klaytn has enjoyed success in South Korea as the country continues to see prolific nonfungible token (NFT) and GameFi use. Klaytn is a product of tech behemoth Kakao – which commands a user base of some 52 million people that use its flagship KakaoTalk application and suite of software products.Klaytn derived its proprietary blockchain technology off the Ethereum Virtual Machine and powers various play-to-earn and AAA games, NFT marketplaces and Metaverses. As its user base continues to grow, the platform is looking to improve its scalability, efficiency and affordability.Klaytn already aggregates over 50 enterprise-level Decentralized Finance (DeFi) service providers and Decentralized Exchanges (DEXs) and the addition of 1inch unlocks a further 257 liquidity sources. Klaytn’s touts the ability to process 4,000 transactions per second and is in the process of implementing a dynamic gas fee mechanism. This is in response to previous exploits of its fixed low gas prices.The ongoing integration of layer two service chains is set to improve token management and oracle services on the metaverse blockchain. Klaytn reported $2.5 billion of total value locked on its protocol in March 2022 and the ongoing merge of various DeFi platforms creates further interoperability between different protocols.Related: DeFi market has room for growth in Korea: 1inch co-founder — KBW 20221inch’s integration with Klaytn provides both userbases access to the 1inch Limit Order Protocol V2, KokonutSwap, KlaySwap, Klap and ClaimSwap. Klaytn plugged into the wider NFT ecosystem through a partnership with NFT marketplace OpenSea in June 2022, giving its users access to a host of NFTs and digital collectibles minted on the Ethereum, Polygon and Solana blockchains.1inch co-founder Sergej Kunz hinted at a move into the Asian market during the Korean Blockchain Week 2022 in Seoul, citing the popularity of blockchain-based games as a potential driver for DeFi adoption. The company’s chief communications officer Sergey Maslennikov echoed these sentiments in correspondence with Cointelegraph as the partnership was unveiled on Aug. 9.“It is quite obvious that Korean share of this market is huge. That’s why we’ve been in thorough and lasting negotiations with Klaytn as an undisputed leader in Korea which ended up in today’s partnership.”Maslennikov also stressed that interoperability between blockchains has been a focus of the DeFi aggregator and the addition of a bridge into the Klaytn ecosystem adds another major blockchain platform to its network.

Čítaj viac

A slice of the punk: CryptoPunk NFT to be split into 56,000 pieces

Nonfungible tokens (NFTs) continue to capture the imagination of the cryptocurrency space, with some of the most popular projects attracting hundreds of millions of dollars from investors. Projects such as CryptoPunks and the Bored Ape Yacht Club epitomize the exclusivity of the most lucrative collections, with each NFT far from accessible to the average investor.A new campaign intends to give a wider base of investors a stake in some of the most valuable NFTs by fractionalizing ownership to reinstate accessibility. Unique Network, an NFT infrastructure running on the Kusama and Polkadot networks, will split the ownership of a CryptoPunk to more than 56,000 addresses that have signed up for a share.The campaign offers users a chance to participate in what has become a highly siloed environment, as Unique Network CEO Alexander Mitrovich explained in a statement:“This represents an exciting moment for interoperability. With our fractionalisation of Cryptopunk #3042 we are heralding a new era of NFTs that are accessible, interchangeable and can be shared across chains, and at a fraction of the cost.”CryptoPunk #3042 was bought for 46.95 Ether (ETH) ($82,000) by Unique Network in June 2022 as cryptocurrency markets slumped to yearly lows. The NFT had originally been sold for $16 in November 2018 before CryptoPunks became one of the most exclusive Ethereum-based projects in the ecosystem and the trail-blazer for crypto-art and NFTs.Unique Network’s acquisition of CryptoPunk #3042 was aimed at democratizing the asset as well as showcasing blockchain interoperability. There is no cost associated with signing up for a share of the CryptoPunk, which forms part of the firm’s Punks for the People campaign. Related: CryptoPunks’ trading volume surges 1,847% after Tiffany & Co. launches exclusive NFT collectionInterestingly, once addresses are airdropped with their individual refungible token, there will be significantly more owners of the single CryptoPunk on the Polkadot blockchain than the entire 10,000 original CryptoPunks running on Ethereum.Unique Network will also fractionalize the ownership of one of its flagship Substrapunk NFTs. Inspired by CryptoPunks, Subtrapunks were the first NFTs to be minted on the Polkadot blockchain. 

Čítaj viac

Ethereum Name Service founder reflects as 2 million registration mark nears

The proliferation of the internet brought the world to the fingertips of users, and with it came a rush to register domains on the nascent network. Businesses like Amazon were born on the internet, while many others took their real-life business online by registering a website.Domain names remain an integral part of the internet, acting as the flagpole of the biggest brands, companies, institutions and individuals. But, the advent of blockchain technology and Web3 has ushered in a new paradigm for domain name hosting.That is where things got interesting. Savvy tech sleuths realized that there was tangible value in registering websites with the names of prominent brands, companies or famous individuals knowing those same people would eventually want to do the same. Thus domain squatting as it is known today was born.There have been some mind-boggling sums paid for domain names as the world gradually went online. Cars.com now holds the record for the most expensive domain name ever sold, with the website itself valued at $872 million as part of its assets in the company’s high-profile sale in 2015.CarInsurance.com fetched almost $50 million and is ranked as the second most expensive domain sold in history. The list goes on and differs according to different sources, with domains like internet.com, sex.com, beer.com and hotels.com ranked as some of the most lucrative DNS addresses to be traded.The practice is still common today, with anecdotes of famous individuals having to fork out large sums to buy a parked domain bearing their name. The process is now repeating itself with the rise of Web3 and blockchain-based domains.ENS bloomsThe Ethereum Name Service (ENS) is seemingly following in the footsteps of conventional domain names, surpassing 1.8 million registrations at the end of July 2022. 378,000 .eth domains were registered in that month alone, generating a monthly record of 5,400 Ether (ETH) in revenue.July 2022 stats for ENS- 378K new .eth registrations (total 1.86m names)- $6.8m in protocol revenue (all goes to the DAO)- 5,400 ETH in revenue (highest ever month)- 48K new eth accounts w/ at least 1 ENS name (total 508k)- >99% of OpenSea domain vol pic.twitter.com/TdD16FOX2d— ens.eth (@ensdomains) August 1, 2022ENS describes itself as a “distributed, open, and extensible naming system” that runs on the Ethereum blockchain. Its purpose is to map human-readable names like “alice.eth” to machine-readable information like cryptocurrency addresses and URLs.ENS is similar to the original Domain Name Service (DNS) in that it uses dot-separated hierarchical names, commonly known as domains, with the owner of a domain in control of it and any subdomains. An ENS domain is effectively a nonfungible token (NFT) that serves as an ETH wallet address, a cryptographic hash or a website URL. Related: Interest in Ethereum Name Service reaching ‘critical mass’Nick Johnson, the founder and lead developer of ENS, outlined the original goal of the project and its subsequent success since inception in correspondence with Cointelegraph. He highlighted two basic goals of the project: naming Ethereum accounts and decentralized resources such as Swarm and InterPlanetary File System (IPFS).Johnson admitted that the team did not realize how valuable the extensibility of the ENS would become as more users began to mint .eth domains. While headlines have highlighted some of the biggest price tags paid for ENS domains, many registrations are carried out by individual users, as the ENS founder explained:“Most people today register ENS names because they serve as their ‘decentralized profile’ — they let people identify themselves with a name, profile picture, social media handles etc., in a way that works across many apps and platforms.”It is hard to ignore parallels between conventional DNS flipping and new-age .eth domain trading. A prime example is the Amazon.eth domain, which grabbed headlines in July 2022 after a $1 million USD Coin (USDC) bid was left to expire by the owner, who’d originally paid $100,000 for the highly sought-after .eth name.Johnson believes the motivation and the market are similar which was part of the reason the firm was cognizant of the potential for conventional domain squatting to be a feature of its ecosystem:“Any time there is a scarce resource, people will look for ways to capitalize on it, and namespaces are no different. Certainly we were aware from day one that this would likely happen, and we tried to structure the service to prioritize end-users over speculators.”Cointelegraph also reached out to John Benjamin, growth hacker at Quantum Economics, to get a gauge of how cryptocurrency analysts are looking at ENS and it’s current trajectory. Benjamin believes both DNS and ENS domains are both high-value assets if marketed correctly while having drastically different reactions to prevailing market conditions. Conventional DNS names typically maintain their value through a bear market, according to Benjamin, while ENS domains may suffer during market volatility:“That being said, the potential profit margins on early ENS access has allowed for the market to continue to bloom, especially as larger companies look to acquire their specific ENS.”Setting aside the volatility of these assets, Benjamin highlighted three key areas which he believes make ENS domains valuable. Firstly, ENS domains are a “great marketing tool” for retail and commercial use. ENS domains bearing the trademark of big brands and companies are also easily flipped, while individuals seem to relish the ability to personalize their online presence:“People love being able to have their own personal identifier, and an ENS allows for that. They can use their Twitter handle and associate their whole persona with their wallet, which is no small thing in a space where people love to be private.”A bright futureThe future of .eth domains and their potential to proliferate the internet still faces some significant hurdles. Would it be comparably easier or more difficult for a layman to go about registering a DNS as opposed to an ENS? Johnson considered this question as a key barrier to entry while suggesting that savvy ETH users would make light work of a .eth registration:“For people who are already in the Ethereum ecosystem and already have a wallet set up, I would argue that registering an ENS name is even simpler than a DNS one.”Johnson concedes that speculators are likely to continue being a natural side-effect of the scarce system and that efforts have been made to prioritize end-users. The ENS founder also cautioned that what starts as a distraction could eventually impede the ability of end users to get names that represent them and use the service for its intended purpose.Benjamin echoed these sentiments, conceding that some ENS domains are overinflated in value. With that being said, some ENS holders may “strike gold” when cryptocurrency markets shift into another bull run. Benjamin’s reasoning is driven by an ever-increasing number of cryptocurrency users during each subsequent bull run:“While it may take up to another two years for a majority of integration, these early adopters will clearly have the advantage. The more ENS they hold, especially of businesses that haven’t entered the Web3 space yet, the greater chance they have of flipping them for a profit as mass adoption continues.”The rise of Web3 leads Benjamin to believe ENS registrations will continue to increase while becoming more targeted at larger companies, sports teams and products that are yet to enter the space but have indicated interest.The ENS community has also played its part in the growth of registrations over the past six months. Johnson previously told Cointelegraph that the platform was reaching a critical mass in awareness and adoption — driven by community groups like the 10kClub, which is made up of users that registered four-digit ENS domains from 0-9999.eth. The group’s Discord channel has almost 7,000 members as of Aug. 5.

Čítaj viac

Cross chains, beware! deBridge flags attempted phishing attack, suspects Lazarus Group

Cross-chain protocols and Web3 firms continue to be targeted by hacking groups as deBridge Finance unpacks a failed attack that bears the hallmarks of North Korea’s Lazarus Group hackers.deBridge Finance employees received what looked like another ordinary email from co-founder Alex Smirnov on a Friday afternoon. An attachment labeled ‘New Salary Adjustments’ was bound to pique interest, with various cryptocurrency firms instituting staff layoffs and pay cuts during the ongoing cryptocurrency winter.A handful of employees flagged the email and its attachment as suspicious, but one staff member took the bait and downloaded the PDF file. This would prove fortuitous, as the deBridge team worked on unpacking the attack vector sent from a spoof email address designed to mirror Smirnov’s.The co-founddelved into the intricacies of the attempted phishing attack in a lengthy Twitter thread posted on Aug. 5, acting as a public service announcement for the wider cryptocurrency and Web3 community:1/ @deBridgeFinance has been the subject of an attempted cyberattack, apparently by the Lazarus group.PSA for all teams in Web3, this campaign is likely widespread. pic.twitter.com/P5bxY46O6m— deAlex (@AlexSmirnov__) August 5, 2022Smirnov’s team noted that the attack would not infect macOS users, as attempts to open the link on a Mac leads to zip archive with the normal PDF file Adjustments.pdf. However Windows-based systems are at risk as Smirnov explained:“The attack vector is as follows: user opens link from email, downloads & opens archive, tries to open PDF, but PDF asks for a password. User opens password.txt.lnk and infects the whole system.”The text file does the damage, executing a cmd.exe command which checks the system for anti-virus software. If the system is not protected, the malicious file is saved in the autostart folder and begins to communicate with the attacker to receive instructions.Related: ‘Nobody is holding them back’ — North Korean cyber-attack threat risesThe deBridge team allowed the script to receive instructions but nullified the ability to execute any commands. This revealed that the code collects a swathe of information about the system and exports it to attackers. Under normal circumstances, the hackers would be able to run code on the infected machine from this point onward.Smirnov linked back to earlier research into phishing attacks carried out by the Lazarus Group which used the same file names:#DangerousPassword (CryptoCore/CryptoMimic) #APT:b52e3aaf1bd6e45d695db573abc886dcPassword.txt.lnkwww[.]googlesheet[.]info – overlapping infrastructure with @h2jazi’s tweet as well as earlier campaigns.d73e832c84c45c3faa9495b39833adb2New Salary Adjustments.pdf https://t.co/kDyGXvnFaz— The Banshee Queen Strahdslayer (@cyberoverdrive) July 21, 2022

2022 has seen a surge in cross-bridge hacks as highlighted by blockchain analysis firm Chainalysis. Over $2 billion worth of cryptocurrency has been fleeced in 13 different attacks this year, accounting for nearly 70% of stolen funds. Axie Infinity’s Ronin bridge has been the worst hit so far – losing $612 million to hackers in March 2022.

Čítaj viac

Získaj BONUS 8 € v Bitcoinoch

nakup bitcoin z karty

Registrácia Binance

Burza Binance

Aktuálne kurzy