Ethereum

United

Discord

Security

<div class="cryptonews">
 <p class="is-style-lead">Trader Joe has swiftly addressed a vulnerability in its analytics plugin, advising users to revoke access to a suspicious contract and restore safety.</p>
 <p>The popular decentralized exchange (DEX) Trader Joe, on Nov. 17 announced a security breach in its frontend interface.&nbsp;</p>
 <p>The breach, identified in a third-party analytics plugin, potentially put numerous users at risk, leading to immediate action by the platform’s team.</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">Important Security Alert<br><br>We have been alerted to a possible vulnerability in our frontend interface. Our team is conducting an immediate and thorough investigation.<br><br>We strongly advise all users to refrain from trading and from executing any transactions on the Trader Joe…</p>— Trader Joe (@TraderJoe_xyz) November 17, 2023
   </blockquote>
  </div>
 </figure>
 <h2 class="wp-block-heading" id="strong-breach-detection-and-immediate-response-strong"><strong>Breach detection and immediate response</strong></h2>
 <p>According to the Trader Joe team, they discovered the vulnerability during a routine check, which revealed compromised JavaScript code in a third-party analytics tool.&nbsp;</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">Update<br><br>Our team's preliminary analysis identified a potential exploit in a 3rd party analytics plugin hacked JavaScript code used by our frontend.<br><br>We've taken immediate action on this finding and the code has been removed, and our host remains secure with no other… https://t.co/hJBRyOF5gW</p>— Trader Joe (@TraderJoe_xyz) November 18, 2023
   </blockquote>
  </div>
 </figure>
 <p>The breach reportedly occurred at approximately 18:34 GMT, affecting all chains, including Avalanche (AVAX), Arbitrum (ARB), and Ethereum (ETH).&nbsp;</p>
 <p>However, the team swiftly removed the malicious code and temporarily shut down the frontend to prevent further risks.</p>
 <p>The incident led to some <a rel="noopener noreferrer nofollow" title="users" href="https://thebittimes.com/tag/users.html">users</a>’ trans<a rel="noopener noreferrer nofollow" title="action" href="https://thebittimes.com/tag/action.html">action</a>s being rerouted to an unknown contract, specifically identified as “0xd8ea07f43bc5045ec49ab52a3da2d0bf533581bf”. It prompted an urgent advisory for <a rel="noopener noreferrer nofollow" title="users" href="https://thebittimes.com/tag/users.html">users</a> who had interacted with the DEX after the <a rel="noopener noreferrer nofollow" title="breach" href="https://thebittimes.com/tag/breach.html">breach</a> to revoke any access given to this contract.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> Fake DJ Marshmello presents sham coin at Web Summit as activists’ campaign
 </div>
 <h2 class="wp-block-heading" id="strong-steps-for-users-to-safeguard-assets-strong"><strong>Steps for users to safeguard assets</strong></h2>
 <p>In response to the breach, Trader Joe advised its users to check and revoke approvals of the malicious contract.&nbsp;</p>
 <p>The DEX directed users to use various tools, including token approval checkers on SnowTrace, Arbiscan, and BSCScan, as well as the Rabby Wallet’s Approval Centre and revoke.cash.&nbsp;</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">Frontend Vulnerability Update<br><br>Some users are reporting that Swaps on the frontend are causing tokens to route to an unknown contract: 0xd8ea07f43bc5045ec49ab52a3da2d0bf533581bf<br><br>First report raised ~30 minutes ago but if you have used the frontend to trade in the last hours… pic.twitter.com/yayO4AYWHP</p>— Trader Joe (@TraderJoe_xyz) November 17, 2023
   </blockquote>
  </div>
 </figure>
 <p>Users could also search for the affected contract address and revoke its access by entering their wallet addresses or connecting their wallets to the suggested services.</p>
 <p>Moreover, the DEX emphasized the importance of confirming contract addresses during trans<a rel="noopener noreferrer nofollow" title="action" href="https://thebittimes.com/tag/action.html">action</a>s, directing <a rel="noopener noreferrer nofollow" title="users" href="https://thebittimes.com/tag/users.html">users</a> to their developer documents for verified and safe contract addresses.&nbsp;</p>
 <p>Additionally, the Trader Joe Discord channel was made available for guided support, although with an advisory on potential delays in response.</p>
 <h2 class="wp-block-heading" id="strong-current-status-and-moving-forward-strong"><strong>Current status and moving forward</strong></h2>
 <p>Following thorough investigation and remediation measures, Trader Joe has restored its frontend, assuring users that it is safe for all activities, including trading, liquidity, staking, and lending.&nbsp;</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">Further Update: Frontend Restored <br><br>Following investigation and removal of the vulnerable 3rd party analytics code, the frontend has now been restored and it is marked safe to use for all activities such as trading, liquidity, staking, lending and more.<br><br>There are no other… https://t.co/bjkeog756u pic.twitter.com/MzLiFdG9bH</p>— Trader Joe (@TraderJoe_xyz) November 18, 2023
   </blockquote>
  </div>
 </figure>
 <p>The DEX reassured users that there are no other third-party integrations or solutions in use, aiming to prevent similar vulnerabilities in the future.</p>
 <p>The breach is the latest incident to affect Trader Joe. In October, the DEX was slapped with a lawsuit by a similarly named grocery retailer alleging trademark infringement and brand dilution.&nbsp;</p>
 <p>The lawsuit targeted the platform as well as its founder Cheng Chieh Liu for deliberately fashioning the DEX to evoke the popular Trader Joe’s brand, an American grocery chain with 560 stores across the United States.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> Read more: </span> Crypto losses soar to $173m in November, driven by Poloniex hack
 </div> <span class="google-news-banner__label">Follow Us on Google News</span>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/trader-joe-suffers-breach-urges-users-to-take-action-tbt70808.html">https://thebittimes.com/trader-joe-suffers-breach-urges-users-to-take-action-tbt70808.html</a></p>

Trader Joe suffers breach, urges users to take action

Table of Contents

TheBitTimes

Other articles published on Nov 18, 2023

Crypto Bull Run Berikutnya: Persetujuan Spot Bitcoin ETF, LINK Melejit 135 Persen dan Return Game...

Ripple XRP Ascending Trajectory: Positive Signals Across Time Frames

Worldcoin WLD Plummets After Sam Altman’s Departure

Bittensor TAO token up over 300% as blockchain and AI integrate

Ethereum (ETH) Rollups Now Have Their Own ERC 4337

Weekly Project Updates: Spread of Multi-Chain Inscriptions, OKX to Launch New Chain X1, Pyth Netw...

Join our free newsletter for daily crypto updates!