<h2 id="header-0">Background:</h2>According to the “<a href="https://www.slowmist.com/report/first-half-of-the-2023-report%28EN%29.pdf" rel="noopener noreferrer nofollow">2023 H1 Blockchain Security and Anti-Money Laundering Report</a>” published by SlowMist, there were 10 instances in the first half of 2023 where losses from attacks were either fully or partially recovered. The total stolen amounted was approximately $232 million from these 10 cases, of which $219 million was recovered, accounting for 94% of the stolen funds. In three of these cases, the stolen funds were completely returned.<img src="https://miro.medium.com/v2/resize:fit:700/1*BLDLkBmNHDLw3M-3A3u9Wg.png" />Hopefully, this can be the new trend where funds are returned after being stolen. Whether the funds are recovered through a bounty or via negotiation, there are primarily two ways of communicating with the party responsible: one is through social media platforms such as twitter, and the other is through on-chain messages between the attacker and the project party.For instance, on March 13, 2023, the DeFi lending protocol Euler Finance was attacked and the attacker profited about $197 million. On March 20, the attacker claimed in an on-chain <a href="https://etherscan.io/tx/0xcc73d182db1f36dbadf14205de7d543cfd1343396b50d34c768529aaab46a1c0" rel="noopener noreferrer nofollow">message</a> to Euler that they now wished to “reach an agreement.” The attacker wrote, “We want to make it easier for all those affected, and we don’t intend to keep what doesn’t belong to us. Let’s set up secure communication and reach an agreement.”<img src="https://miro.medium.com/v2/resize:fit:700/0*Dejvbg0zWQHdUhiX" />A few hours later, Euler responded on-chain <a href="https://etherscan.io/tx/0x9c25b6ca65c5bd0597a13ceae6f0d6edcef4b10279f338114550926ad0387ce4" rel="noopener noreferrer nofollow">saying</a>, “Message received, let’s discuss this privately through Euler Deployer address and one of your EOAs on Blockscan, via the email contact&#64;euler.foundation or any other channel of your choice. Please reply with your preferred method.”<img src="https://miro.medium.com/v2/resize:fit:700/0*qDVSa9lIjsTj6_yS" />Interestingly, on March 15, a user named 0x2af sent an on-chain <a href="https://etherscan.io/tx/0xbe21a9719a4f89f7dc98419f60b247d69780b569cd8869c0031aae000f98cf17" rel="noopener noreferrer nofollow">message</a> to the hacker, requesting the return of their life savings, 78 wstETH, stating, “Please consider returning 90% / 80%. I am just a user, and my life savings consist only of the 78 wstETH I deposited in Euler. I am not a whale or a millionaire. You can’t imagine how bad my situation is, it’s ruined. I’m sure $20 million is enough for you to change your life, and you can bring joy back to many affected people.” The hacker then sent them 100 ETH. Immediately afterwards, many addresses imitated the user’s behavior and sent messages to hackers.<img src="https://miro.medium.com/v2/resize:fit:700/0*9ZK8uOoyUYTaut-j" />Of course, there are also cases of phishing attempts through on-chain messages. On March 22, 2023, after completing the attack, the Euler hacker transferred 100 ETH to the Ronin hacker, who had stolen over $625 million, in an attempt to create confusion and evade pursuit. The Ronin hacker seized the opportunity, returned the favor with 2 ETH, and sent an on-chain <a href="https://etherscan.io/tx/0xcf0b3487dc443f1ef92b4fe27ff7f89e07588cdc0e2b37d50adb8158c697cea6" rel="noopener noreferrer nofollow">message</a> to the Euler hacker asking them to decrypt an encrypted message. However, experts claimed that the message was a phishing scam attempting to steal the private key of the Euler attacker’s wallet. We once wrote an <a href="https://slowmist.medium.com/uncovering-the-twist-attack-vulnerability-was-this-a-failed-scam-by-ronin-exploiter-539111187aa6" rel="noopener noreferrer nofollow">analysis </a>of this incident, which can be referred to if interested. Minutes after the Ronin hacker’s wallet sent a message to the Euler hacker’s wallet, Euler Finance’s developers attempted to intervene with their own <a href="https://etherscan.io/tx/0x054409f252ac293a0ed34108b25e5906476817c5489bd3e98a5d3e1ee0825020" rel="noopener noreferrer nofollow">message</a>, warning the Euler hacker to be wary of any so-called decryption software and stating, “The easiest method is to return the funds.” The developers of Euler continued in another <a href="https://etherscan.io/tx/0x1fd6d2e67a2ac4cf7c1718cc3058d5625171b95d66744801c97a4de54a41197b" rel="noopener noreferrer nofollow">transaction</a>, “Under no circumstances should you attempt to read the message. Do not input your private key anywhere. Be aware, your machine could also be compromised.”<img src="https://miro.medium.com/v2/resize:fit:700/0*iDBF0WsQbLkrWl_s" /><h2 id="header-1">What is on-chain message?</h2>As we know, Bitcoin and Ethereum mainnet are essentially globally distributed ledger systems. Take Ethereum as an example; currently, more than ten thousand Ethereum nodes are copying all data on the Ethereum mainnet. This means that any message, transaction, or information on the Ethereum mainnet will be replicated thousands of times, ensuring the immutability of blockchain information. The Ethereum mainnet is generally more “affordable” compared to the Bitcoin network, hence most people prefer Ethereum for their first choice for on-chain messaging. As mentioned earlier, the essence of the blockchain is a distributed ledger, so when we conduct a transactions, we’re able to leave a message. These messages are recorded on all nodes’ ledgers, cannot be modified, and stored on the blockchain.The first to start leaving messages on the blockchain was Satoshi Nakamoto. On January 4, 2009, Satoshi left the headline news of the day from The Times on the genesis block, “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks,” which we can still find on the chain today.<img src="https://miro.medium.com/v2/resize:fit:700/0*rlvFd-7xRa3Ba-CC" /><h2 id="header-2">How to Leave Messages on the Chain?</h2>Basic: Unencrypted Messages(1) Leave a message via <a href="https://app.mycrypto.com/send" rel="noopener noreferrer nofollow">https://app.mycrypto.com/send</a>Connect your wallet, fill in the recipient’s address and transfer amount (which can be 0 ETH). In the Data field, type in the message you want to leave after ‘0x’. Then, click ‘Next’, and finally ‘Confirm’.<img src="https://miro.medium.com/v2/resize:fit:700/0*YYxyAcYmRJshKLjL" />Note: The message needs to be in hexadecimal format, so you can convert it in advance using some conversion tools or websites.<img src="https://miro.medium.com/v2/resize:fit:700/0*Shza_342qD51Lrov" />(2) Leave a message via a mobile wallet transferYou need to use an Ethereum wallet with some ETH (such as MetaMask or imToken wallet) to complete the transaction and pay the Gas fee. For example, open the imToken wallet, input a transfer address to make a transfer transaction, click ‘Advanced Mode’, enter the hexadecimal format message (remember to start with “0x”).<img src="https://miro.medium.com/v2/resize:fit:700/1*qhQFojYJWtJgPCYnGaw4iw.png" />(3) Leave a message using the <a href="https://etherscan.io/idm" rel="noopener noreferrer nofollow">Etherscan IDM</a> tool<img src="https://miro.medium.com/v2/resize:fit:700/0*-I56xBCTiYiUo3hG" />With this tool, you don’t need to input processed hexadecimal data in ‘Input Data’. You can directly type in the message you want to leave, and it will automatically process it into hexadecimal data for you. The results are shown as follows:<img src="https://miro.medium.com/v2/resize:fit:700/0*D_TxXP5AZ7M9MbJF" /><img src="https://miro.medium.com/v2/resize:fit:700/0*6-aSEY4xKqX4-650" />Advanced: Encrypted MessagesWe’ve discussed unencrypted messages, and there are also encrypted messages. Let’s start with an example:<img src="https://miro.medium.com/v2/resize:fit:700/0*h3Q6E-ghVdsQrB7U" />(https://bscscan.com/tx/0xfa1fa7cdfa3c5fe2cfaf61e14caf4b5174302d3801b09bb650d3f90ec706c3e9)Address ‘0x313’ sent an on-chain message to the address marked as ‘TransitFinance Funds Receiver’: “Please use the private key of your address to decrypt this message”, and attached a large piece of information that needs to be decrypted to be seen.So, how are encrypted on-chain messages realized?Reference: <a href="https://cryptobook.nakov.com/asymmetric-key-ciphers/ecies-example" rel="noopener noreferrer nofollow">https://cryptobook.nakov.com/asymmetric-key-ciphers/ecies-example</a>(1) EncryptionFirstly, search for the transaction hash via Etherscan:<img src="https://miro.medium.com/v2/resize:fit:700/0*wDpLhqDN2SFeBQ1j" />Then, obtain the original transaction hexadecimal data of the transaction hash:<img src="https://miro.medium.com/v2/resize:fit:700/0*UcLp60GrNiFoSljJ" />Next, retrieve the public key based on the original transaction hexadecimal data:<img src="https://miro.medium.com/v2/resize:fit:700/0*IoflTB1Gc0mmAMt9" />Finally, enter ‘SecretMessage’ and ‘publicKey’, and run the following code:<img src="https://miro.medium.com/v2/resize:fit:700/1*XMeFx3ss5-IotEVTZUY3uQ.png" /><img src="https://miro.medium.com/v2/resize:fit:700/0*-NPO5KS4gnzEVpZ7" />Finally, use the above tool to send.(2) DecryptionInput PrivateKey and encrypted and run the following code:<img src="https://miro.medium.com/v2/resize:fit:700/1*HnAyLYb7HojnyN7e1hSsBA.png" /><img src="https://miro.medium.com/v2/resize:fit:700/0*ytXcO0_qe57gjSdH" /><h2 id="header-3">Example of SlowMist Assisting in On-Chain Messaging</h2>As a blockchain threat intelligence security company, SlowMist often receives assistance requests from project parties or individual users. Here’s an example. On October 2, 2022, the cross-chain trading platform aggregator Transit Swap was hacked, with stolen assets exceeding $28.9 million. At the request of the project party, we assisted them in negotiating with the attacker.Here are some parts of the negotiation process:<img src="https://miro.medium.com/v2/resize:fit:700/0*VX5gJmKhIQhyxzm7" />(https://bscscan.com/tx/0x7491671cfab5066d5a36299cf295e721611bae6ff61a847a32b11d1cf716c274)<img src="https://miro.medium.com/v2/resize:fit:700/0*p4jENhZnjhHjYyib" />(https://bscscan.com/tx/0xfa1fa7cdfa3c5fe2cfaf61e14caf4b5174302d3801b09bb650d3f90ec706c3e9)According to the official statement on October 12, 2022, “the white hat has returned $24 million in funds”.<h2 id="header-4">Conclusion</h2>This article mainly introduces the relevant knowledge and usage of on-chain messages. On-chain messages, as a form of anonymous communication, on the one hand, due to the immutability and transparency of on-chain information, this is equivalent to passively accepting the “scrutiny” of the public, which may avoid to some extent one party reneging afterwards; on the other hand, it provides a platform for communication between the victim and the attacker, increasing privacy, providing an opportunity to reduce financial losses for the victim, but also beware of phishing information in the messages.In addition to on-chain messages, users and project parties can still increase the possibility of retrieving funds in the following ways:<ul><li>Immediately notify relevant agencies: report and complain to local law enforcement agencies, financial regulatory agencies and relevant blockchain project teams. Provide detailed information and evidence, and cooperate with the investigation of relevant institutions;</li><li>Contact the trading platform: if the funds were stolen on a certain trading platform, contact them immediately and provide detailed information about the incident. The trading platform may take measures to investigate and assist in resolving the issue;</li><li>Cooperate with the community: publicize the incident and cooperate with relevant community members to share information and experience. Other users may provide useful information about the attacker or attack techniques;</li><li>Seek professional help: consult a professional blockchain security company or lawyer for professional legal and technical assistance. They can provide relevant advice and guidance, help to retrieve funds as much as possible or take other appropriate legal measures. You can also contact the SlowMist AML team by submitting the <a href="https://aml.slowmist.com/en/recovery-funds.html" rel="noopener noreferrer nofollow">form</a>.</li></ul>Of course, the most important thing is to take preventive measures to reduce the risk of funds being stolen, including using safe and reliable wallets and trading platforms; protecting private keys and access credentials; avoiding clicking on suspicious links and downloading software from unknown sources; and maintaining security awareness and knowledge update. Finally, it is highly recommended to read the “<a href="https://github.com/slowmist/Blockchain-dark-forest-selfguard-handbook/blob/main/README.md" rel="noopener noreferrer nofollow">Blockchain-dark-forest-selfguard-handbook</a>” produced by SlowMist.About SlowMistSlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.Website&#xff1a;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">https://www.slowmist.com</a>Twitter&#xff1a;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">https://twitter.com/SlowMist_Team</a>Github&#xff1a;<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">https://github.com/slowmist/</a>

Establishing On-Chain Communication After an Incident

Table of Contents

SlowMist

Other articles published on Aug 8, 2023

Understanding Crypto Swap Taxes: A Comprehensive Guide

Circle Addresses USDC Liquidity Concerns Amid Global Expansion

Bitcoin turns green as large whales make moves

Crypto Stocks Rise in July Despite Bitcoin’s Slip: Here’s Why

Shopping Video Raises Eyebrows Amid SEC Lawsuit Against Richard Heart

Real World Asset Lending Protocol Goldfinch Face Loan Default

Join our free newsletter for daily crypto updates!