2024

DeFi

Yield Protocol

April

Yield

<p>The post <a href="https://coinpedia.org/news/crypto-weekly-hack-report-week-witnesses-the-biggest-ever-address-poisoning-attack/" rel="noopener noreferrer nofollow">Crypto Hack Weekly Report: DeFi Double Trouble &amp; A $70M Phishing Attack</a> appeared first on <a href="https://coinpedia.org" rel="noopener noreferrer nofollow">Coinpedia Fintech News</a></p>
<h2 class="wp-block-heading" id="h-29th-april-to-4th-may-2024"><strong>29th April to 4th May 2024</strong></h2>
<p>This week has been particularly eventful in the crypto world, marked by significant hacks that have been felt throughout the community. From Pike Finance’s second breach in just a few days to a trader’s unfortunate loss due to a phishing scam, the landscape of crypto security has once again come into focus.</p>
<p>There’s still a lot to be learned from an unfortunate situation. Here’s what went down.</p>
<h2 class="wp-block-heading" id="h-a-detailed-recap"><strong>A Detailed Recap</strong></h2>
<h3 class="wp-block-heading" id="h-1-pike-finance-suffers-double-attack"><strong>1. Pike Finance Suffers Double Attack </strong></h3>
<p><a href="https://coinpedia.org/news/pike-finance-hit-with-second-attack-in-three-days-with-losses-of-1-6-million/" rel="noopener noreferrer nofollow">Pike Finance</a>, a notable DeFi lending platform, faced its second exploit within a short span of three days, resulting in a substantial loss of $1.68 million across Ethereum, Arbitrum, and Optimism networks.</p>
<p>The attacker exploited critical flaws in Pike Finance’s smart contracts, gaining control over the protocol’s output address. This orchestrated move led to the transfer of $1.4 million worth of ETH, $150 thousand of OP, and over $100 thousand of ARB.</p>
<p>Interestingly, this incident occurred shortly after another breach on April 26th, where Pike Finance lost $300,000, indicating vulnerabilities in its security measures.</p>
<h3 class="wp-block-heading" id="h-2-yield-protocol-vulnerable-and-exploited"><strong>2. <strong>Yield Protocol: Vulnerable and Exploited</strong></strong>!</h3>
<p>In a cautionary tale, the defunct DeFi lending platform, Yield Protocol, fell victim to hackers who exploited vulnerabilities on the <a href="https://coinpedia.org/news/latest-security-breach-hits-arbitrum-hedgey-finance-loses-1-9-million-in-hacker-attack/" rel="noopener noreferrer nofollow">Arbitrum blockchain</a>. Despite going offline in December 2023, Yield Protocol suffered a theft of approximately $181,000 in crypto assets due to manipulations within its smart contracts.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Hi <a href="https://twitter.com/yield?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@yield</a>, you may want to a look (w/ $181K) <a href="https://t.co/wbzVgrvyyy" rel="noopener noreferrer nofollow">pic.twitter.com/wbzVgrvyyy</a></p>— PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1785121607192817692?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 30, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Investigations revealed that the attacker exploited anomalies in pool tokens using flash loan assets, highlighting the importance of robust security measures. Unfortunately, attempts to recover the stolen assets were futile as support for Yield Protocol had ceased months prior.</p>
<h3 class="wp-block-heading" id="h-3-a-costly-mistake"><strong>3. A Costly Mistake </strong></h3>
<p>More complex is a case when this crypto user mistakenly sent his 1,155 WBTC Wrapped Bitcoin to a bad actor’s wallet losing $68 million. His wallet was <a href="https://coinstats.app/address/0xd9A1C3788D81257612E2581A6ea0aDa244853a91/" rel="noopener noreferrer nofollow">drained of over 97%</a> of its total assets. The rest of its contents have since been removed, leaving them with just $13.56 worth of ETH.&nbsp;</p>
<p>The vulnerability was based on imitating an <a href="https://coinpedia.org/news/attacker-steals-71-million-in-an-extremely-sophisticated-phishing-attack-that-fooled-the-investor/" target="_blank" rel="noopener noreferrer nofollow">ETH transfer</a> of 0.05 ETH and causing the victim to send a large number of WBTCs instead. The transfer history of the victim was breached and the victim was made to send the money to the address belonging to the real exploiter who presented his address as legitimate.&nbsp;</p>
<p>This method of address poisoning confirmed by reputable blockchain security firms such as <a href="https://twitter.com/CertiKAlert/status/1786378165050306774" target="_blank" rel="noopener noreferrer nofollow">CertiK</a>, proves how seriously cryptocurrency owners should safeguard their transactions from sophisticated phishing attacks.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/CertiKInsight?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#CertiKInsight</a> <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"><br><br>Our system has detected a transfer of 1,155 WBTC (~$69.3m) to an address linked to address poisoning<br><br>EOA 0xd9A1 mimicked a transfer of 0.05 ETH which led the victim to send the funds to the wrong address<br><br>Stolen funds are here <a href="https://t.co/m2xpJW0QIZ" rel="noopener noreferrer nofollow">https://t.co/m2xpJW0QIZ</a> <a href="https://t.co/PWFhEsEN2G" rel="noopener noreferrer nofollow">pic.twitter.com/PWFhEsEN2G</a></p>— CertiK Alert (@CertiKAlert) <a href="https://twitter.com/CertiKAlert/status/1786378165050306774?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 3, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Also Check Out: <a href="https://coinpedia.org/news/attacker-steals-71-million-in-an-extremely-sophisticated-phishing-attack-that-fooled-the-investor/" rel="noopener noreferrer nofollow">Attacker Steals $71 Million in an Extremely Sophisticated Phishing Attack That Fooled the Investor</a></p>
<p>These examples should serve as a wake-up call to all crypto users, regardless of experience. As technology evolves, so do the tactics of those seeking to exploit it. By staying informed about the latest threats, implementing robust security measures, and exercising skepticism, users can navigate the crypto markets with ease.</p>

Crypto Hack Weekly Report: DeFi Double Trouble & A $70M Phishing Attack

Table of Contents

CoinPedia News

Other articles published on May 4, 2024

Weekly Project Updates: LayerZero Initiates Sybil Hunt Operation, Eigenlayer Launches First Seaso...

Dogecoin’s Dip Signals Imminent Bull Run, Expert Analyst Predicts

Floki Hits 7-Day High, Can FLOKI Surpass Past $0.000343 ATH?

Bitgert (BRISE): The Rising Crypto Star Set to Dominate in May 2024

Beginner’s Guide to Cryptocurrency: Top 3 Coins to Start With – Ethereum, Solana and BlastUP

Next Cryptocurrency to Explode Saturday, May 4 — Stacks, ORDI, Render, Dogecoin

Join our free newsletter for daily crypto updates!