Bittensor

UwU Lend

Lykke

DeFi

ZachXBT

<p><em>Crypto-Sec is our bi-weekly round-up of crypto and cybersecurity stories and tips. </em></p>
<h2 class="wp-block-heading" id="h-biggest-phish-of-the-week-tao-holder-loses-11-2-million">Biggest phish of the week: TAO holder loses $11.2 million</h2>
<p>In the largest reported phishing attack so far in June, a user of the Bittensor (TAO) artificial intelligence platform lost over 28,000 tokens worth $11.2 million at the time. The attack was reported by onchain sleuth ZachXBT through his Telegram channel.</p>
<p>The attacker split up the funds into 18 different wallet accounts, which then consolidated them into 16 accounts, ZachXBT reported. Afterward, the 16 accounts bridged the tokens from the TAO network to Ethereum and swapped them for ETH and USDC stablecoin using three different decentralized exchanges.</p>
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="642" height="570" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Reported-phishing-attack-against-TAO-holder.png" alt="Reported phishing attack against TAO holder" class="wp-image-33742" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Reported-phishing-attack-against-TAO-holder.png 642w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Reported-phishing-attack-against-TAO-holder-300x266.png 300w" sizes="(max-width: 642px) 100vw, 642px">
 <figcaption class="wp-element-caption">
  <em>Reported phishing attack against TAO holder. (ZachXBT)</em>
 </figcaption>
</figure>
<p>Splitting up funds into multiple wallets and then recombining them is a common tactic of scammers and is designed to circumvent money laundering detection systems on centralized exchanges. It is this pattern of splitting and recombining that apparently led ZachXBT to conclude that this was a phishing attack.</p>
<p>A crypto phishing attack is a type of scam in which the attacker creates a fake website that appears to be part of a legitimate protocol, such as a decentralized exchange or lending app. But the site is, in fact, malicious and not authorized by the legitimate protocols team. When the user authorizes their tokens to be spent by the fraudulent app, it steals them instead of doing what the user expected.</p>
<p>Phishing scams are one of the most common ways for crypto users to lose their funds from an attack.</p>
<section class="adv-banner adbutler-ad adbutler-ad__desktop">
 <div class="container">
  <a href="https://servedbyadbutler.com/go2/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img decoding="async" src="https://servedbyadbutler.com/adserve/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img"></a>
 </div>
</section>
<section class="adv-banner adbutler-ad adbutler-ad__mobile">
 <div class="container">
  <a href="https://servedbyadbutler.com/go2/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img decoding="async" src="https://servedbyadbutler.com/adserve/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img"></a>
 </div>
</section>
<h2 class="wp-block-heading" id="h-white-hat-corner-microsoft-patches-zero-click-vulnerability">White hat corner: Microsoft patches zero-click vulnerability</h2>
<p>According to Security Week, Microsoft has <a href="https://www.securityweek.com/microsoft-patches-zero-click-outlook-vulnerability-that-could-soon-be-exploited/" target="_blank" rel="nofollow">patched</a> a vulnerability that could have allowed attackers to execute code on Outlook users devices without requiring them to download or execute a file. Cybersecurity firm Morphisec reportedly discovered the flaw.</p>
<p>The potential attack only required the user to open a malicious email rather than needing to download or run a file. For this reason, Morphisec referred to the flaw as a zero-click vulnerability.</p>
<p>Morphisec reported that the flaw allowed attackers to exfiltrate data, gain unauthorized access to systems, and perform other malicious activities.&nbsp;</p>
<p>Crypto software wallets use key vault files stored on the device to sign transactions, so these files could potentially have been stolen through such an attack and led to crypto losses.</p>
<p>Despite Microsofts patch, some devices may still be running older versions of Outlook, so [u]sers are advised to update their Outlook clients as soon as possible, the report stated.</p>
<figure class="wp-block-image aligncenter size-full is-resized">
 <img decoding="async" width="800" height="337" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Microsoft-Common-Vulnerabilities-and-Exposures-CVE-report-on-the-Outlook-flaw.png" alt="Microsoft Common Vulnerabilities and Exposures (CVE) report on the Outlook flaw" class="wp-image-33741" style="width: 100%;height:auto" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Microsoft-Common-Vulnerabilities-and-Exposures-CVE-report-on-the-Outlook-flaw.png 800w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Microsoft-Common-Vulnerabilities-and-Exposures-CVE-report-on-the-Outlook-flaw-300x126.png 300w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Microsoft-Common-Vulnerabilities-and-Exposures-CVE-report-on-the-Outlook-flaw-770x324.png 770w" sizes="(max-width: 800px) 100vw, 800px">
 <figcaption class="wp-element-caption">
  <em>Microsoft Common Vulnerabilities and Exposures (CVE) report on the Outlook flaw. (Microsoft)</em>
 </figcaption>
</figure>
<p>Microsoft listed the vulnerability as important but did not label it as critical. The flaw affected earlier versions of Outlook 2016, Office LTSC 2021, 365 Apps for Enterprise, and Office 2019, but the most current versions of these apps are not vulnerable.</p>
<div class="article-suggest"> 
 <div class="article-suggest__title display3">
  Read also
 </div> 
 <div class="article-suggest__items"> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/real-ai-use-cases-crypto-no-2-ai-can-run-dao/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Real AI use cases in crypto, No. 2: AIs can run DAOs</p> </a> 
  </div> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/base-meme-coins-scams-vulnerabilities-honeypot/" class="article-suggest__subtitle display4"> <span>Features</span> <p>1 in 6 new Base meme coins are scams, 91% have vulnerabilities</p> </a> 
  </div>
 </div>
</div>
<h2 class="wp-block-heading" id="h-defi-exploit-of-the-week-uwu-lend-gets-exploited-twice">DeFi exploit of the week: UwU Lend gets exploited twice</h2>
<p>DeFi protocol UwU Lend On Ethereum was exploited twice by the same attacker over a period of three days. The first attack occurred on June 10 and drained $20 million from the protocol, while the June 13 second attack drained an additional $3.7 million, according to reports from blockchain security platforms Peck Shield and Cyvers.</p>
<p>In a June 12 X post, the team <a href="https://x.com/UwU_Lend/status/1800864462825787824" target="_blank" rel="nofollow">acknowledged</a> the first attack, stating that the attacker had manipulated the price oracle for Ethena Staked USD (sUSDe), but the team patched the vulnerability once it was discovered. The team has now identified the vulnerability, which was unique to the sUSDe market oracle and has now been resolved, it claimed.</p>
<p>According to blockchain security platform Peck Shield, the attacker manipulated the sUSDe oracle used by the protocol, causing it to show false prices. This allowed some liquidity pools to lend $20M more than they otherwise would have been able to. The attacker then pocketed these funds for themselves and did not pay back the loans.</p>
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="600" height="605" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Tweet.png" alt="Tweet" class="wp-image-33743" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Tweet.png 600w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Tweet-298x300.png 298w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/Tweet-100x100.png 100w" sizes="(max-width: 600px) 100vw, 600px">
 <figcaption class="wp-element-caption">
  <em>(Peck Shield)</em>
 </figcaption>
</figure>
<p>To explain in more detail: The protocols sUSDe oracle used an average price derived from multiple liquidity pools. Using large flash loans, the attacker was able to change the prices in four of these pools: FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD and GHOUSDe. This affected the price recorded by the sUSDe oracle, which in turn changed the collateral requirements for loans in the protocol. The attacker used these altered requirements to take out insufficiently collateralized loans, allowing them to default on the loans and run off with the borrowed funds.</p>
<p><strong><em>Related: </em></strong><a target="_blank" href="https://cointelegraph.com/explained/what-are-flash-loans-in-defi"><em><strong>What are flash loans in DeFi?</strong></em></a></p>
<p>Some $14.4 million worth of drained funds were <a href="https://etherscan.io/address/0x050c7e9c62bf991841827f37745ddadb563feb70" target="_blank" rel="nofollow">sent</a> to an account ending in EB70, and another $4.6 million were <a href="https://etherscan.io/address/0x48d7c1dd4214b41eda3301bca434348f8d1c5eb6" target="_blank" rel="nofollow">transferred</a> to an account ending in 5EB6. The stolen loot consists entirely of Ether (<a href="https://cointelegraph.com/ethereum-price" target="_blank" rel="nofollow">ETH</a>), as the attacker swapped all other tokens for ETH immediately following the attack.</p>
<p>On June 12, the UwU team announced that it had paid back the bad debt for Tether (<a href="https://cointelegraph.com/tether-price-index" target="_blank" rel="nofollow">USDT</a>), DAI, and crvUSD, allowing these markets to relaunch.</p>
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="800" height="451" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/UwU-Lend-interface-showing-relaunched-markets.png" alt="UwU Lend interface showing relaunched markets" class="wp-image-33744" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/UwU-Lend-interface-showing-relaunched-markets.png 800w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/UwU-Lend-interface-showing-relaunched-markets-300x169.png 300w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/06/UwU-Lend-interface-showing-relaunched-markets-770x434.png 770w" sizes="(max-width: 800px) 100vw, 800px">
 <figcaption class="wp-element-caption">
  <em>UwU Lend interface showing relaunched markets. (UwU Lend)</em>
 </figcaption>
</figure>
<p><strong><em>Related: </em></strong><a target="_blank" href="https://cointelegraph.com/news/uwu-lend-hack-20-million"><em><strong>UwU Lend Hit by $20m Hack</strong></em></a></p>
<p>However, on the day after this announcement, Cyvers announced that the attacker had <a href="https://x.com/CyversAlerts/status/1801163462816473466" target="_blank" rel="nofollow">executed</a> a second exploit against UwU Lend. This second attack targeted the uDAI, uWETH, uLUSD, uFRAX, uCRVUSD, and uUSDT pools, draining $3.7 million from them.</p>
<p>The exploit of UwU Lned had knock-on effects, which ended with the Curve CRV token going into freefall and its multiple-mansion-owning founder, Michael Egorov, liquidated for a $140 million stablecoin position.</p>
<p>This led to news reports stating that Egorov has proposed burning 10% of the CRV token supply, valued at $37 million, to help stabilize the token’s price.</p>
<p>Sadly, the burn story was a hoax tweeted by an Egorov impersonator attempting to phish users. The real Egorov told <a href="https://cointelegraph.com/news/curve-ceo-clarifies-uwu-hack-misinformation" target="_blank" rel="nofollow">Cointelegraph</a>:</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>This information was tweeted by a fake (impersonator) account, accompanied by a scam link. Few journalists did not fact-check the news and published news about this.</p>
</blockquote>
<div class="article-suggest"> 
 <div class="article-suggest__title display3">
  Read also
 </div> 
 <div class="article-suggest__items"> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/storming-the-last-bastion-angst-and-anger-as-nfts-claim-high-culture-status/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Storming the last bastion: Angst and anger as NFTs claim high-culture status</p> </a> 
  </div> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/financial-decentralized-exchange-dex/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Are You Independent Yet? Financial Self-Sovereignty and the Decentralized Exchange</p> </a> 
  </div>
 </div>
</div>
<h2 class="wp-block-heading" id="h-deepfake-scams-okx-user-loses-2m">Deepfake scams: OKX user loses $2m</h2>
<p>According to a translated report from Chinese crypto media outlet Wu Blockchain, one OKX user <a href="https://www.wublock123.com/index.php?m=content&amp;c=index&amp;a=show&amp;catid=46&amp;id=27855" target="_blank" rel="nofollow">lost</a> over $2 million from a deepfake scam generated through artificial intelligence (AI). The attackers purchased Lai J. Fang Changs personal data on Telegram and used it to create a video application synthesized by AI to change mobile phone number.&nbsp;</p>
<p>The video reportedly tricked staff on the OKX platform into authorizing changes to Changs password, email address and Google Authenticator device, bypassing all two-factor authentication controls. The attackers then withdrew all of Changs crypto into wallet accounts under their control.</p>
<p>According to the report, OKX is currently investigating the attack.</p>
<p><strong><em>Related: </em></strong><a target="_blank" href="https://cointelegraph.com/news/ai-driven-crypto-crime-2024-elliptic-report"><em><strong>AI-driven crypto crime is only just beginning Elliptic report</strong></em></a></p>
<h2 class="wp-block-heading" id="h-cexs-somaxbt-claims-hack-coverup-on-lykke-exchange">CEXs: SomaXBT claims hack coverup on Lykke exchange</h2>
<p>On June 9, blockchain researcher SomaXBT <a href="https://x.com/somaxbt/status/1799812652610511043" target="_blank" rel="nofollow">accused</a> Lykke exchange of hiding its $22 million loss from a June 4 hack. The researcher started looking into the matter after noticing that several Lykke users had complained of being unable to withdraw funds. The exchange had reportedly stated on Discord that the platform was undergoing maintenance.</p>
<p>But after investigating, SomaXBT discovered that over $19 million of Bitcoin (<a href="https://cointelegraph.com/bitcoin-price" target="_blank" rel="nofollow">BTC</a>) and ETH had been transferred from multiple wallet accounts into a new address, which he says implies that the exchange may have been hacked. The researcher claimed that Lykke was still trying to hide this fact, as five days had passed without the exchange making an official statement.</p>
<p>The following day, Lykke <a href="https://x.com/lykke/status/1800186135299408013" target="_blank" rel="nofollow">acknowledged</a> the attack and expressed apologies to its users for the inconvenience of not being able to withdraw. It also promised to repay all users, claiming that it has solid capital reserves and a diverse portfolio with which to do this.</p>
<p><strong><em>Related: </em></strong><a target="_blank" href="https://cointelegraph.com/news/lykke-crypto-exchange-acknowledges-hack-halting-withdrawals"><em><strong>Lykke crypto exchange acknowledges hack after halting withdrawals</strong></em></a></p>
<div class="subscribe subscribe--inner">
 <div class="container">
  <div class="subscribe__inner">
   <div class="subscribe__content"> 
    <div class="subscribe__title display2">
     Subscribe
    </div> 
    <div class="subscribe__desc text-l">
     The most engaging reads in blockchain. Delivered once a week.
    </div> 
    <div class="wpcf7 no-js" id="wpcf7-f13672-o1" lang="en-US" dir="ltr">
     <div class="screen-reader-response">
      <p role="status" aria-live="polite" aria-atomic="true"></p> 
      <ul></ul>
     </div>
     <form action="/magazine/wp-json/wp/v2/posts?_embed&amp;per_page=100#wpcf7-f13672-o1" method="post" class="wpcf7-form init subscribe__form demo" aria-label="Contact form" novalidate data-status="init">
      <div style="display: none;">
       <input type="hidden" name="_wpcf7" value="13672">
       <input type="hidden" name="_wpcf7_version" value="5.7.7">
       <input type="hidden" name="_wpcf7_locale" value="en_US">
       <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f13672-o1">
       <input type="hidden" name="_wpcf7_container_post" value="0">
       <input type="hidden" name="_wpcf7_posted_data_hash" value="">
      </div>
      <fieldset class="form-group">
       <p><input size="40" class="wpcf7-form-control wpcf7-text wpcf7-email wpcf7-validates-as-required wpcf7-validates-as-email" id="footer-subscribe" aria-required="true" aria-invalid="false" value="" type="email" name="your-email"><label for="footer-subscribe">Email address</label></p>
      </fieldset>
      <p><button class="subscribe__btn btn btn-white">SUBSCRIBE</button></p>
      <div class="wpcf7-response-output" aria-hidden="true"></div>
     </form>
    </div>
   </div>
   <div class="subscribe__img"> 
    <img decoding="async" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2022/10/reading-copy.png" alt="Subscribe to Magazine by Cointelegraph Newsletter.">
   </div>
  </div>
 </div>
</div>

Crypto-Sec: $11M Bittensor phish, UwU Lend and Curve fake news, $22M Lykke hack

Table of Contents

Cointelegraph

Other articles published on Jun 17, 2024

BlockDAG Edges Out Tron & ORDI Coin in the Battle for Top Layer 1 Crypto Crown with 30,000x Profi...

XRP Price Forecast: Why Is XRP Pumping While Bitcoin Struggles?

Slothana and Bonk Slip Behind as MoonBag Coin Rockets to the Top With 88% APY Staking, Aiming for...

Bitcoin Dominance On The Rise Amid Altcoin Pullback; New DeFi Presale Looks To Deliver Huge Profi...

BlockDAG Network Sales Explode Post X1 Miner App Release; Set to Eclipse UNI Price & ICP Crypto

XLink onboards Fireblocks, Ancilia to prevent another $10M hack

Join our free newsletter for daily crypto updates!