Gateway Protocol

Bitcoin

Silk Road

Avalanche

Balancer

<div class="sg-post-des">
 Blockchain security firms SlowMist and CertiK also believe the crypto wallet drainer Angel Drainer was involved in the estimated $238,000 exploit. 
</div> 
<div class="cointelegraph"> 
 The team behind Balancer, an Ethereum-based automated market maker, believes a <a rel="noopener noreferrer nofollow" title="social" href="https://thebittimes.com/tag/social.html">social</a> <a rel="noopener noreferrer nofollow" title="engineering" href="https://thebittimes.com/tag/engineering.html">engineering</a> <a rel="noopener noreferrer nofollow" title="attack" href="https://thebittimes.com/tag/attack.html">attack</a> on its DNS service <a rel="noopener noreferrer nofollow" title="provider" href="https://thebittimes.com/tag/provider.html">provider</a> was what led to its <a rel="noopener noreferrer nofollow" title="website" href="https://thebittimes.com/tag/website.html">website</a>’s frontend being compromised on Sept. 19, leading to an estimated $238,000 in crypto stolen. 
 “After investigation, it is clear that this was a social engineering attack on EuroDNS, the domain registrar used for .fi TLDs,” the firm explained in a Sept. 20 X post. 
 Approximately 8 hours after the first warning of the attack, Balancer said its decentralized autonomous organization (DAO) was actively addressing the DNS attack and was working to recover the Balancer UI. 
 At 5:45 pm UTC on Sept. 20, Balancer said it was successful in securing the domain and bringing it back under the control of Balancer DAO. It also confirmed its subdomains “app.balancer.fi” and other “balancer.fi” are safe to use again. 
 <blockquote class="twitter-tweet"> 
 After investigation it is clear that this was a social engineering attack on EuroDNS, the domain registrar used for .fi TLDs. We are exploring deprecating the .fi TLD in order to move to a more secure registrar and suggest that other projects using the TLD do the same. [2/2]— Balancer (@Balancer) September 20, 2023 
 </blockquote> 
 However, it suggested any other projects using the same top-level domain should consider moving to a more secure registrar.&nbsp; 
 EuroDNS is a Luxembourg-based domain name registrar and DNS service provider. Cointelegraph has reached out to EuroDNS for comment. 
 <h3 id="angel-drainer-involved">Angel Drainer involved</h3> 
 Blockchain security firms SlowMist and CertiK&nbsp;reported&nbsp;that&nbsp;the attacker employed Angel Drainer phishing contracts. 
 SlowMist said the exploiters attacked the Balancer’s website via Border Gateway Protocol hijacking — a process where hackers take control of IP addresses by corrupting internet routing tables. 
 The hackers then induced users to “approve” and transfer funds via the “transferFrom” function to the Balancer exploiter, it explained. 
 Related: Breaking: ‘All funds are at risk' — Steadefi exploited in ongoing attack 
 The hacker, whom SlowMist believes may be related to Russia, has already bridged some of the stolen Ether (ETH) to Bitcoin (BTC) addresses via THORChain before eventually being bridging the ETH back to Ethereum, blockchain security firm SlowMist explained on Sept. 20. 
 SlowMist stated in an earlier post that the hacker transferred about 15 wrapped-Ether (wETH.e) on the Avalanche blockchain. 
 <blockquote class="twitter-tweet"> 
 Balancer Hack Update So far, we have the following findings about the @Balancer exploiter: 1/ The attacker’s fee came from the phishing group #AngelDrainer. In other words, after the attacker (AngelDrainer) attacked the website via BGP hijacking, then induced users to… https://t.co/5g6P2aPEz8 pic.twitter.com/3PInfe9VC1— MistTrack️ (@MistTrack_io) September 20, 2023 
 </blockquote> 
 Meanwhile, despite Balancer confirming its subdomains, balancer.fi to now be safe, visits to the website still shows “Deceptive site ahead” warning when attempting to access the Balancer’s website. 
 <figure> 
 <img src="https://cdn.thebittimes.com/images/2023/09/21/baf1343d050d9977a31f9ad4b6d607ce.webp"> 
 <figcaption style="text-align: center;"> Balancer’s website as of Sept. 20 at 10:22 pm UTC. Source: Balancer. 
 </figcaption> 
 </figure> 
 Cointelegraph reached out to Balancer to confirm the amount of funds lost but did not receive an immediate response. 
 Magazine: $3.4B of Bitcoin in a popcorn tin: The Silk Road hacker’s story 
 <template data-name="subscription_form" data-type="defi_newsletter"></template> 
</div> 
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/balancer-blames-social-engineering-attack-on-dns-provider-for-website-hijack-tbt63459.html">https://thebittimes.com/balancer-blames-social-engineering-attack-on-dns-provider-for-website-hijack-tbt63459.html</a>

Balancer blames ‘social engineering attack’ on DNS provider for website hijack

Table of Contents

TheBitTimes

Other articles published on Sep 21, 2023

Babydoge Reaches 2M Followers, Oak Grove Fund Raises $60M, and CONG Token Emerges as the Best Pre...

High-Stakes Heist: Thieves Steal 22 Million Rubles in Cryptocurrency Equipment from Chelyabinsk M...

Daily Analysis: BTC, ETH, AAVE, ALGO, CRV

eToro Gains Approval to Offer Crypto Trading in Europe

ASIC Initiates Legal Action Against Bit Trade Over Crypto Margin Trading Product

Exclusive interviews with Casino funders

Join our free newsletter for daily crypto updates!