Ethereum

Railgun

PancakeSwap

<p style="text-align: justify">Maestro, one of the largest Telegram crypto trading bot projects in the ecosystem, has been targeted in a hack attack. The attack resulted in the theft of dozens of <a href="https://en.coin-turk.com/important-development-ethereum-co-founder-vitalik-buterin-transfers-3000-eth-worth-4-95-million/" data-wpel-link="internal" rel="noopener noreferrer nofollow">Ethereum</a> (<a href="https://en.coin-turk.com/crypto-market-recovers-bitcoin-soars-and-altcoins-choose-directions/" data-wpel-link="internal" rel="noopener noreferrer nofollow">ETH</a>) from the crypto trading bot’s smart contract.</p>
<h2 style="text-align: justify" id="280-eth-stolen-from-the-bot">280 ETH Stolen from the Bot</h2>
<p style="text-align: justify">Findings after the hack attack reveal that the Telegram crypto trading bot fell victim to a critical security vulnerability in its Router2 contract, allowing unauthorized transfers of over 280 ETH (worth $500,000) from user accounts. The Maestro team took immediate action to fix the issue, but temporary access to tokens in liquidity pools on certain decentralized exchanges (DEXes) was suspended.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-270041" src="https://coin-turk.com/wp-content/uploads/2023/10/Telegram-kriptom-Ticaret-Botu-Maestro.jpeg" alt="" width="1280" height="720"></p>
<p style="text-align: justify">The smart contract designed to manage token swaps was found to have a security vulnerability that allowed hackers to make arbitrary calls and unauthorized transfers of funds. According to the blockchain security company PeckShield, the funds were likely transferred to the cross-chain exchange platform Railgun to hide their origin.</p>
<p style="text-align: justify">The essence of the problem was that the Router2 contract had a proxy design that allowed changes to the contract logic without changing the wallet address, which is typically a feature for upgradability. This design also allowed arbitrary and unauthorized calls, enabling hackers to initiate “transferFrom” operations between any approved wallet address.</p>
<p style="text-align: justify">Exploiting this vulnerability, the hackers entered a token wallet address into the Router2 contract and set the function to “transferFrom,” listing Maestro’s wallet address as the sender and their own wallet addresses as recipients. In this way, unauthorized token transfers were made from Maestro’s wallet addresses to the hackers’ wallet addresses.</p>
<h2 style="text-align: justify" id="router-operations-suspended-in-maestro">Router Operations Suspended in Maestro</h2>
<p style="text-align: justify">Immediately after the hack attack was detected, the Maestro team took action by completely changing the Router2 contract and quickly suspending all router operations, preventing further unauthorized fund transfers from the smart contract.</p>
<p style="text-align: justify">The Maestro team confirmed that the security vulnerability has been addressed, but tokens in the SushiSwap, ShibaSwap, and ETH PancakeSwap pools will not be available for a while due to ongoing inspections. The team announced that refunds will be made to all users whose funds were stolen. The statement said, “We will inform the community as soon as we are ready to process the refunds (hopefully within the day).”</p> Continue Reading: <a href="https://en.coin-turk.com/maestro-one-of-the-biggest-telegram-crypto-trading-bots-hacked-280-eth-stolen/" data-wpel-link="internal" rel="noopener noreferrer nofollow">https://en.coin-turk.com/maestro-one-of-the-biggest-telegram-crypto-trading-bots-hacked-280-eth-stolen/</a>

Maestro, One of the Biggest Telegram Crypto Trading Bots, Hacked: 280 ETH Stolen

Table of Contents

COINTURK NEWS

Other articles published on Oct 25, 2023

XRP Lawsuit: Judge Torres Terminates Ripple Vs SEC Hearings, Orders New Deadline

BlackRock pays $2.5 million fine to SEC for misleading investors

AI Anxiety Peaks as Sam Altman’s Warning on Superhuman Persuasion Rattles Tech Enthusiasts

Bitcoin Surprises Jim Cramer with a Powerful Price Movement

Ripple vs SEC Lawsuit Update: Court Issues New Order, Next Step?

Over 30 Crypto Companies Collaborate to Provide Aid in Israel

Join our free newsletter for daily crypto updates!