<p>Weekly Update | Approximately $59.63 Million Lost to Web3 Security Incidents</p><h2 id="header-0"><strong>Overview</strong></h2><p>According to statistics from the Slowmist Blockchain Black Archives (https://hacked.slowmist.io), from July 24 to 30, 2023, there were seven security incidents involving Palmswap, MetaLabz, Eralend, Carson, DefiLabs, Kannagi Finance, and Curve Finance. The total estimated loss stands at approximately $59.63 million, attributed to tactics such as Rug Pull, flash loan attacks, and re-entry lock failure.</p><h2 id="header-1">Specific Incidents</h2><h3 id="strong-palmswap-strong"><strong>Palmswap</strong></h3><p>On July 25, 2023, the Palmswap project on the BSC chain was attacked, with the assailant profiting over $900,000. The attack resulted from the core function’s permission control feature being inactive, and the liquidity token’s price calculation model being overly simplistic. On July 28, Palmswap tweeted that 80% of the stolen funds had been returned, with the remaining 20% being regarded as the hacker’s bug bounty.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CM8eBxg1hc2M8ZdlX0hic0ZtqqcYTOnPiassiaF0wfGDJa7bhrHBR4R9PQ/640?wx_fmt&#61;png" /></p><h3 id="strong-metalabz-strong"><strong>MetaLabz</strong></h3><p>On July 25, 2023, MetaLabz tweeted, “To secure our supply, we deployed an unaudited contract that was exploited. The situation was exacerbated by subsequent liquidity attacks, resulting in losses slightly above 400 BNB.”</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7COiagXrQOG0dDWs4HiaJBCcS6nwZgxa9VM3StypdJaXcjvn9rbicOw8icUw/640?wx_fmt&#61;png" /></p><h3 id="strong-eralend-strong"><strong>Eralend</strong></h3><p>On July 25, 2023, multiple users reported that the Zksync-based lending protocol Eralend suffered a flash loan attack. The attackers manipulated the oracle prices, exploiting approximately $2.76 million from the USDC pool. All other pools remained unaffected.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CxIhian2Bstc5cO8p66sbewgVCxzjoNTPJjW6vgfnsjTPSC8VlTywXBA/640?wx_fmt&#61;png" /></p><h3 id="strong-carson-strong"><strong>Carson</strong></h3><p>On July 27, 2023, Carson of the BSC ecosystem was attacked, resulting in a loss of approximately $145,000. The Carson token price has plunged by 96%, with the attacker having converted the stolen assets into 600 BNB and transferred to Tornado Cash.</p><h3 id="strong-defilabs-strong"><strong>DefiLabs</strong></h3><p>On July 28, 2023, DefiLabs on the BNB chain has absconded, taking away approximately $1.6 million. DeFiLabs claimed on Twitter that the platform encountered “unexpected issues” during “maintenance and updates”.</p><h3 id="strong-kannagi-finance-strong"><strong>Kannagi Finance</strong></h3><p>On July 29, 2023, the zkSync Era yield aggregator protocol Kannagi Finance executed a Rug Pull, rendering its official Twitter and official frontend ineffective. DeFiLlama data shows that Kannagi Finance’s TVL was $2.13 million yesterday, and it’s nearly zero now, predicting a user loss of $2.13 million.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CCHccR4kUmCFic1mRmGqDxzWJic6xGHCxvVYiaNyBpv8icvxmTxS3lElRFg/640?wx_fmt&#61;png" /></p><h3 id="strong-curve-finance-alchemix-jpeg-d-etc-strong"><strong>Curve Finance/Alchemix/JPEG’d etc.</strong></h3><p>On July 30, 2023, Curve Finance tweeted that many stablecoin pools using Vyper 0.2.15 were attacked due to re-entry lock failure, causing a cumulative loss of approximately $52 million. As of now, the Curve Finance TVL has fallen to $1.869 billion, a decrease of 42.5% in the past 24 hours.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CA7T5LLG85seyNFxrLXOnJWcdQFvUhJX5HUWwUgVSaYTQZ4NxcxktOQ/640?wx_fmt&#61;png" /></p><p>Alchemix recently announced that Curve Finance alerted them about a potential vulnerability in their alETH/ETH pool due to an issue with Vyper. Alchemix swiftly removed the liquidity controlled by AMO contracts from the Curve pool. The vulnerability was executed on the Curve pool contract, but Alchemix’s smart contracts were not attacked, ensuring the safety of the funds. Alchemix needs to perform three transactions: withdrawing LP tokens from Convex, extracting alETH from the Curve pool, and extracting ETH from the Curve pool. The first transaction, which involves withdrawing LP tokens from Convex, has been completed. Following the second transaction, 8,000 ETH was removed from the Curve pool. There remains approximately 5,000 ETH liquidity in the Curve pool that is controlled by the AMO. During the process of removing the remaining liquidity, the alETH/ETH Curve pool was attacked. At present, the alETH reserve has suffered a loss of approximately 5,000 ETH.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7C9fffibwCibfpXNliafhFV6QTRkbLzswkoBkETUIicreYDibuUoLHO1vyDvQ/640?wx_fmt&#61;png" /></p><p>According to an analysis by MistTrack, the initial funds for the Curve CRV/ETH exploiter (0xb75…324) came from Binance.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CXcicFH8I8zR8iaXBPBtVV9zziaVncrK5eAB9b7DzItKg76OhIgT88R1FQ/640?wx_fmt&#61;png" /></p><p>Moreover, the Curvefi: Deployer (0xbab…f67) once sent an on-chain message to the CRV/ETH exploiter (0xb75…324).</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CY1B4ibs6B2AAhzTQHzpZ0rBFCEhLJL6GVPiak4Wvy8cQhCZecrO9HlSQ/640?wx_fmt&#61;png" /></p><p>As of now, the CRV/ETH exploiter (0xb75…324) has transferred all the profit, consisting of 35.26 ETH, 7,193,401.77 CRV, and 7,680.49 WETH, to a new address (0xB1C…148).</p><p><img src="https://mmbiz.qpic.cn/mmbiz_png/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CGPoUw7Htqepc0Uw2olyA9B6NEZM8KpB9nsUWyNR4qkazO17QeTEffg/640?wx_fmt&#61;png" /></p><p>In another update from July 22, the Estonian crypto payment service provider CoinsPaid announced that it had suffered a cyber attack, resulting in the theft of cryptocurrencies worth $37.3 million. On July 26, the SlowMist team tweeted that the attackers behind CoinsPaid, Atomic, and Alphapo may all belong to the North Korean hacker group Lazarus Group.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_jpg/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CP3puP5QyNpicF7Czy0IKDutBrBtLI5xLKC2RhmFjjY7ialWaIqRQkIpw/640?wx_fmt&#61;jpeg" /></p><h2 id="header-2"><strong>Further analysis revealed:</strong></h2><p>1) The address TGG…1Ag received a large transfer of 118,351,300 TRX from the address TJF…3ym, which is related to the Alphapo incident.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_jpg/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CY13G5L58iaKwSr18sRXQMN0gh3xm1J2qaibq8VnntzUiaQeJaREKGzUmw/640?wx_fmt&#61;jpeg" /></p><p>2) TGG…1Ag received funds from the Coinspaid hot wallet on July 22, which flowed out through the addresses TNM…Jem and TJ6…xuf.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_jpg/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7CAQm3pD3H4SMeu9DlrGsVMUfRGFiaUTBwibRJ4GUa4j18KEaOjludMhYA/640?wx_fmt&#61;jpeg" /></p><p>3) The address TNM…Jem received funds from the address TJX…JQx used by the Atomic Wallet exploiter, which could be related to Lazarus/DPRK.</p><p><img src="https://mmbiz.qpic.cn/mmbiz_jpg/qsQ2ibEw5pLYVicYoc98PHia3vwG9RS2E7Cib1qcvgLsue5YstxxWl4ZuRFWgMycoThn4icia3PYdFQH6kf3xgtCAzaw/640?wx_fmt&#61;jpeg" /></p><h2 id="header-3"><strong>Summary</strong></h2><p>The major cause of security incidents this week has been flash loan attacks. Flash loans are innovative products in decentralized finance, allowing users to borrow and repay in the same transaction (block) without any collateral. A single on-chain transaction can contain multiple operations, allowing developers to incorporate other on-chain operations between borrowing and repaying. This has led to the rise of flash loan attacks. Although flash loans themselves do not contain vulnerabilities, they can be exploited to manipulate prices or arbitrage across multiple protocols at a very low cost, posing a risk. The SlowMist security team advises DeFi project teams to always remain vigilant, conduct regular security audits, track and resolve new security threats and vulnerabilities, and protect projects and assets to the greatest extent possible.</p><h3 id="about-slowmist">About SlowMist</h3><p>SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, Cheers UP, etc.</p><p>SlowMist offers a variety of services that include by are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.</p><p>By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.</p><p>Website&#xff1a;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">https://www.slowmist.com</a></p><p>Twitter&#xff1a;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">https://twitter.com/SlowMist_Team</a></p><p>Github&#xff1a;<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">https://github.com/slowmist/</a></p>

SlowMist Weekly Security Update July 24 to 30

Table of Contents

SlowMist

Other articles published on Aug 1, 2023

Tron Founder Partnered With This Altcoin! Purchased $2 Million!

Boeing Stock Price Prediction: BA Stock Gains 15% After Results?

The Rise of Stablecoins: Unleashing the Potential and Impact on the Crypto Market

Binance Wins Dubai License, Expands Services in UAE

Richard Heart to SEC Amid Lawsuit: I Saved More People in Crypto Than You Did

Shiba Inu’s Triple Treat: Third Birthday, Nearly $2M ROI, 3.30T SHIB off CEX, Elon Musk’s Shibari...

Join our free newsletter for daily crypto updates!