Stablecoin

Ethereum

Arbitrum

Seneca

Security

Update Feb. 29, 10:17 UTC: This article has been updated to add comments from CertiK's Joe Green.
Stablecoin protocol Seneca has offered a 20% bounty to the exploiter who gained access to at least $6.4 million in digital assets after exploiting an approval mechanism bug in the protocol’s smart contract.&nbsp;
On Feb. 28, multiple blockchain security firms <a href="https://twitter.com/CertiKAlert/status/1762871285036511328" target="_blank" rel="noopener nofollow">flagged</a> the exploit on the stablecoin protocol. Companies like CertiK warned users about the exploit, urging them to revoke approvals from an address on the Ethereum and Arbitrum networks. Initial <a href="https://twitter.com/spreekaway/status/1762857769714012217" target="_blank" rel="noopener nofollow">estimates</a> of the losses were at $3 million, but it was later found that over 1,900 Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>), worth about $6.4 million, were taken from the exploit. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/a9596b4c-030d-42fa-98b4-422cb9ce6e3a.jfif" alt="" title="">
 <figcaption style="text-align: center;">
 Seneca attacker’s wallet showing about $3 million in Ether. Source: CertiK
 </figcaption>
</figure>
Security analysts at CertiK explained that the exploit happened due to a critical “call” vulnerability in the protocol’s smart contract. Joe Green, the head of CertiK's quick response team, told Cointelegraph that this vulnerability allowed the attacker to perform external calls to any address. Green explained:&nbsp;
<blockquote data-ct-non-breakable="true">
 In this incident, an attacker was able to perform arbitrary external calls to transfer assets from addresses that had granted approvals to the vulnerable contracts directly to themselves.
</blockquote>
Green added that a key takeaway from this incident is to pay attention to any external calls, particularly when upgrading contracts. This means that while a contract may be secure during its deployment, it may break on certain instances. “A entrusts B; B entrusts C; C entrusts D, but a new upgrade may break when A is not supposed to trust D,” Green shared.&nbsp;
Related: <a href="https://cointelegraph.com/news/shido-token-plummet-attacker-drains-staking-contract">Shido token plummets 94% as exploiter drains Ethereum staking contract</a>
Seneca said it is&nbsp;<a href="https://twitter.com/SenecaUSD/status/1762886130561630227" target="_blank" rel="noopener nofollow">working</a> with specialists to investigate what happened. It also <a href="https://twitter.com/SenecaUSD/status/1762999045109248461" target="_blank" rel="noopener nofollow">offered</a> a $1.2 million bounty for the return of the stolen funds. In an on-chain message on Feb. 29, Seneca asked the hacker to return 80% of the stolen funds to an Ethereum address, allowing the hacker to keep 20%. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/5f99ada6-0a75-4af9-b561-ab8b1e8ab91e.png" alt="" title="">
 <figcaption style="text-align: center;">
 Seneca’s on-chain message to the exploiter. Source: Seneca
 </figcaption>
</figure>
Within the message, Seneca said it is collaborating with security providers and law enforcement to trace the funds. It urged the hacker to return the funds to avoid legal consequences. “Acting promptly is crucial, so we kindly request that you return the funds as soon as possible to avoid any further legal action,” it wrote. 
Hours after Seneca’s message, the hacker&nbsp;<a href="https://twitter.com/PeckShieldAlert/status/1763109818766946512" target="_blank" rel="noopener nofollow">returned</a> about 1,537 ETH, worth around $5.3 million, to the wallet address Seneca specified. The exploiter kept 300 ETH, worth around $1 million, and accepted the 20% bounty offered by Seneca. The exploiter then transferred the ETH to two different addresses. 
Magazine: <a href="https://cointelegraph.com/magazine/defis-billion-dollar-secret-the-insiders-responsible-for-hacks/">DeFi’s billion-dollar secret: The insiders responsible for hacks</a>

Seneca stablecoin hacker returns stolen funds after $6.4M exploit

Cointelegraph

Other articles published on Feb 29, 2024

UFO Gaming Announces Super Galactic Closed Beta Campaign

Ethereum (ETH) Price Prediction for February 29

Is Baidu’s Profit Drop a Reflection of the High Costs of AI Development?

SEC Raises Concern on $166 Million Legal Fee by Terra- Report

Trending Crypto Tokens: Dogwifhat Price Predicted to Hit $1 and BEFE to Reach $0.001

Why Bitgert Coin Prevails Over Solana in the Cryptocurrency Arena

Join our free newsletter for daily crypto updates!