ParaSwap

Rocket

Tornado Cash

Rocket Pool

Tornado

<a href="https://bitcoinworld.co.in/paraswap-refunded-users-as-augustus-v6-hacker-faces-ultimatum/" title="ParaSwap Refunded Users as Augustus V6 Hacker Faces Ultimatum" rel="noopener noreferrer nofollow"></a>
<ul>
 <li style="font-weight: 400">ParaSwap has refunded some users affected by a vulnerability in one of its Augustus V6 contract.</li>
 <li style="font-weight: 400">The platform later contacted the hacker and issued an ultimatum.</li>
 <li style="font-weight: 400">It remains unclear how much was stolen following the vulnerability.</li>
</ul>
Decentralized finance (DeFi) aggregator ParaSwap has commenced returning crypto assets to users recently affected by a critical vulnerability in one of the platform’s newly deployed contracts.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 White hack recovery update: Assets have been returned to wallets which have revoked their permissions
 If your wallet had assets transferred to 0x66e90d840d7c4f3473e25dd8ca361747058c6db0 and have not received them yet, your wallet is still vulnerable, PLEASE REVOKE ALL RELEVANT… <a href="https://t.co/zraj3tSFNe" rel="noopener noreferrer nofollow">https://t.co/zraj3tSFNe</a>
 — ParaSwap (@paraswap) <a href="https://twitter.com/paraswap/status/1771964824542441528?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">March 24, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
On March 20, ParaSwap identified a vulnerability in its Augustus V6 contract, allowing hackers to drain funds from over 386 exposed wallets when approved. The platform paused the contract and conducted a white hack to secure funds for users who were at risk.
See Also: <a class="row-title" href="https://bitcoinworld.co.in/hacker-behind-phishing-attack-on-rocket-pool-transfers-10m-to-tornado-cash/" aria-label="“Hacker Behind Phishing Attack On Rocket Pool Transfers $10M To Tornado Cash” (Edit)" rel="noopener noreferrer nofollow">Hacker Behind Phishing Attack On Rocket Pool Transfers $10M To Tornado Cash</a>
<h3 id="span-style-font-weight-400-paraswap-disburses-user-funds-issues-ultimatum-to-hacker-span">ParaSwap Disburses User Funds, Issues Ultimatum to Hacker</h3>
According to a recent update on X, ParaSwap has returned crypto assets to wallets that revoked their permissions to the Augustus v6 contract and were successfully recovered by white hat hackers.
A few hours later, the ParaSwap team shared another post detailing its steps to identify the hacker and launch the investigation into the stolen funds.
In addition to submitting a “comprehensive report to the appropriate authorities” and collaborating with Chainalysis and TRM Labs to trace the movement of the funds, ParaSwap initiated contact with the hacker via on-chain messaging, urging them to return the stolen user funds.
The platform advised the hacker to transfer the funds directly to a specific address by March 27 or face serious consequences.
“If we do not hear back from you by Wednesday, March 27, 2024, 23:00 UTC we will assume you appropriated the funds with unlawful intent and we will pursue all criminal, legal, and administrative avenues available for the purpose of recovering the misappropriated funds,” ParaSwap <a href="https://paraswap.notion.site/V6-vulnerability-on-chain-messaging-89d2af5234a146f2908f4be2c5b2edb2" rel="noopener noreferrer nofollow">wrote</a>.
Although there is a likelihood that ParaSwap might recover the funds if the hacker heeds the call, it remains unclear how much was exactly stolen.
<h3 id="span-style-font-weight-400-how-much-was-stolen-span">How Much Was Stolen?</h3>
While ParaSwap initially said only four addresses were compromised on March 20 and lost a total of $24,000, blockchain security firm Cyvers reported that the Augustus V6 contract vulnerability resulted in a total loss of $123,500.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">UPDATE<img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"><a href="https://twitter.com/paraswap?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@paraswap</a>'s vulnerability resulted in a total loss of $123.5K across <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a>, <a href="https://twitter.com/hashtag/POLYGON?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#POLYGON</a>, and <a href="https://twitter.com/hashtag/ARB?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#ARB</a>. <a href="https://twitter.com/hashtag/ETH?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#ETH</a> TRX: 0x1de32e063b42cfa8c288810871c080902847ce9e823d48975d67b6702319b3d9<a href="https://twitter.com/hashtag/Polygon?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Polygon</a> TRX: 0x1de32e063b42cfa8c288810871c080902847ce9e823d48975d67b6702319b3d9… <a href="https://t.co/VX8UgWx6Uw" rel="noopener noreferrer nofollow">https://t.co/VX8UgWx6Uw</a>
 — <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> Cyvers Alerts <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@CyversAlerts) <a href="https://twitter.com/CyversAlerts/status/1770375243900629497?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">March 20, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
Meanwhile, of the 386 addresses exposed to the vulnerability, only 173 have received their funds, and 213 addresses have yet to revoke allowances to the flawed contract. Per ParaSwap, these addresses are still vulnerable and might be exploited.
<blockquote>
 Disclaimer: The information provided is not trading advice. Bitcoinworld.co.in holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
</blockquote>
&nbsp;
#Binance #WRITE2EARN
The post <a href="https://bitcoinworld.co.in/paraswap-refunded-users-as-augustus-v6-hacker-faces-ultimatum/" rel="noopener noreferrer nofollow">ParaSwap Refunded Users as Augustus V6 Hacker Faces Ultimatum</a> appeared first on <a href="https://bitcoinworld.co.in" rel="noopener noreferrer nofollow">BitcoinWorld</a>.

ParaSwap Refunded Users as Augustus V6 Hacker Faces Ultimatum

Table of Contents

ItsBitcoinWorld

Other articles published on Mar 25, 2024

Goldman Sachs Says Hedge Fund Clients Flock to Crypto After Bitcoin ETF Approval

Binance’s successor in Russia CommEx announces closure

EXGOLAND and EXGO Token: Building an Immersive Ecosystem for Tomorrow

Crypto Investment Products See $942 Million Outflows, GBTC Plays Spoilsport

Bitcoin’s April Halving Sparks Global Mining Shift

RippleX urges caution amid XRPL AMM pool glitch

Join our free newsletter for daily crypto updates!