ZachXBT

Security

TrueAUD

/send

TrueUSD

<div class="protos">
 <div>
 <div>
 <div>
 Recently, the team behind <a rel="noopener noreferrer nofollow" title="TrueUSD" href="https://thebittimes.com/tag/trueusd.html">TrueUSD</a> was forced to disclaim TEURO — a <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> deployed at the same address — suggesting that private keys historically associated with its <a rel="noopener noreferrer nofollow" title="TUSD" href="https://thebittimes.com/tag/tusd.html">TUSD</a> <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> have been compromised.
 Funds related to this false token have also been tied to the deployment of TCNY, another apparently fake token unaffiliated with the ‘real’ TrueTokens. This comes as TrueUSD has had to disclose a hack of customer information.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 In regards to the recent $TEURO, we want to clarify that we have zero affiliation with it. When evaluating newly deployed contracts, it’s essential to be cautious and understand the potential risks We strongly advise you to step back and refrain from risky investments!— TrueUSD (@tusdio) October 16, 2023
 </blockquote>
 </div>
 </figure>
 This token was deployed by address 0x7bA7EF06A2621267f063eF2DB2d482D5B507D8b3, which does correspond to the address that originally deployed the TUSD contracts. However, TrueUSD now claims that this address “has NO permissions over TUSD smart contracts; it was exclusively designated for token deployment.”
 The company also claims, “It holds NO authority over current TUSD contracts or user token assets and has NO impact on TUSD’s operations. This address is NOT owned or controlled by the TUSD team, and there is NO affiliation between the TUSD team and this address.”
 The firm concludes, “Since the end of 2020, the <a rel="noopener noreferrer nofollow" title="TUSD" href="https://thebittimes.com/tag/tusd.html">TUSD</a> team has gained ownership of the <a rel="noopener noreferrer nofollow" title="TUSD" href="https://thebittimes.com/tag/tusd.html">TUSD</a> contract. Rest assured, your <a rel="noopener noreferrer nofollow" title="TUSD" href="https://thebittimes.com/tag/tusd.html">TUSD</a> <a rel="noopener noreferrer nofollow" title="tokens" href="https://thebittimes.com/tag/tokens.html">tokens</a> are secured by our smart contracts, which are securely owned and managed by the <a rel="noopener noreferrer nofollow" title="TUSD" href="https://thebittimes.com/tag/tusd.html">TUSD</a> team. Once again, the security of <a rel="noopener noreferrer nofollow" title="TUSD" href="https://thebittimes.com/tag/tusd.html">TUSD</a> remains our top priority.”
 This statement, in some sense, appears to contradict a previous claim from Monica Ho of Archblock to Protos, where she discussed how, for TrueUSD, “the private keys have been handed over to the Techteryx engineering team.”&nbsp;
 Independent crypto researcher ZachXBT tracked fund movements related to the deployment of TEURO, noting that one of the addresses that received TEURO bridged funds over to Arbitrum before bringing them back to Ethereum. The original TrueAUD deployer then created another fake <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> in TrueCNY.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 1/3 If they legitimately did not create TEURO as stated then I would agree the deployed private key is probably compromised since the TUSD deployer also deployed the TEURO contract. Following where they minted TEURO tokens is where things get a bit more interesting…— ZachXBT (@zachxbt) October 23, 2023
 </blockquote>
 </div>
 </figure>
 Further complicating this story is the fact that TrueUSD recently had to disclose that it was compromised, tweeting, “TUSD team was informed by TrueCoin that they received a third-party vendor’s notification that the vendor’s Security Team detected ‘an anomalous’ account chance within [TrueCoin’s] organization made by a compromised support vendor.'”&nbsp;
 Blockchain intelligence firm ChainArgos highlighted how this represents a potentially larger attack on TrueUSD. It highlighted that TUSD allows for more ‘automated’ minting and redemption by users than many other stablecoins, potentially allowing hackers to quickly obtain funds related to the stablecoin.&nbsp;
 ChainArgos says a potential attack relies on the hacker being able to mint more TUSD into accounts and transfer them to the stUSDT mint address. That account was able to burn those TUSD, potentially redeeming those tokens and accessing those funds.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 2/ This is particularly interesting if you know how $TUSD works. $TUSD customers all go through KYC/AML checks and each have an on chain redemption address that is tied to a real world bank account with "fintech". Each TrueUSD customer has a pre-set limit on how much they can… pic.twitter.com/p06jmyOblk— ChainArgos (@ChainArgos) October 23, 2023
 </blockquote>
 </div>
 </figure>
 Read more: FTX knew Justin Sun tried to acquire TrueUSD
 These transfers all happened before the disclosed hack date and rely on loss of control of keys, which so far hasn’t been disclosed. This means that these transfers could be related to non-hack activity by Justin Sun.
 Protos has previously reported that stUSDT is almost entirely controlled via entities and addresses believed to be owned or controlled by Sun.&nbsp;
 Protos has reached out to TrueUSD with a series of questions to clarify the nature of this hack.
 Got a tip? Send us an email or ProtonMail. For more informed news, follow us on&nbsp;X,&nbsp;Instagram,&nbsp;Bluesky, and&nbsp;Google News, or subscribe to our&nbsp;YouTube&nbsp;channel.
 </div>
 </div>
 </div>
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/trueusd-was-hacked-and-issued-fake-tokens-tbt67461.html">https://thebittimes.com/trueusd-was-hacked-and-issued-fake-tokens-tbt67461.html</a>

TrueUSD was hacked and issued fake tokens

TheBitTimes

Other articles published on Oct 23, 2023

Blockaid secures $33m in series A funding for crypto security

Top Reasons Why Bitcoin Price is Up Today

ZCASH 2023: Will Bulls Support ZEC In Destroying The Trendline?

Pendiri PayPal Diduga Jadi Informan FBI Sejak 2021

Blockchain Association director of government relations recaps speaker candidates’ records on cry...

Crypto spot volumes soar as Bitcoin rallies – Find out why

Join our free newsletter for daily crypto updates!