Heroes of Mavia

Crypto scams, hacks and exploits and how to avoid them: Crypto-Sec
<h2 class="wp-block-heading" id="defi-exploits-ivest-hit-with-donation-attack">DeFI exploits: iVest hit with donation attack</h2>
Decentralized Finance protocol iVest Finance was the victim of a $156,000 exploit on Aug. 12, according to a report from blockchain security firm QuillAudits.
Transferring tokens to a null address (0x0) usually causes them to be lost forever. However, in the iVest protocol, transfers to the null address cause a _MakeDonation function to be called, which in turn causes the senders balance [to be] incorrectly reduced by double the intended amount, QuillAudits reported.
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="753" height="862" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/ivest-attack-quill-audits.jpg" alt="QuillAudits reports iVest attack" class="wp-image-35104" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/ivest-attack-quill-audits.jpg 753w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/ivest-attack-quill-audits-262x300.jpg 262w" sizes="(max-width: 753px) 100vw, 753px">
 <figcaption class="wp-element-caption">
 Source: QuillAudits
 </figcaption>
</figure>
The attacker repeated these steps over and over again, successfully draining over $156,000 worth of BNB and iVest tokens from the pool, most of which had been deposited by other users.
Quill stated that it would provide more updates as information becomes available.&nbsp;
On its website, iVest describes itself as a project that combines SocialFi and DAO governance with unique tokenomics to support our members and create thriving community projects.
iVest acknowledged the attack through its official Telegram channel. “[U]nfortunately last night a hacker was able to run an exploit and steal some money from the DAO using a mechanism intended for donations,” it stated, adding that it has “identified the exploit and will work with a professional security firm to complete a full audit.”
The team also stated that it will replace the lost funds and resume normal operations once the security audit has been completed.
<h2 class="wp-block-heading" id="malware-vulnerability-amd-sinkclose-affects-millions">Malware vulnerability: AMD Sinkclose affects millions</h2>
Millions of PCs are affected by a vulnerability in AMD processors discovered on Aug. 9, according to a report from Wired. The discovery could be especially concerning for users who run software wallets such as MetaMask, Coinbase Wallet, Trustwallet or others on these devices.
The vulnerability, called Sinkclose, allows an attacker to <a href="https://www.wired.com/story/amd-chip-sinkclose-flaw/?s=31" target="_blank" rel="nofollow">create</a> a bootkit that evades antivirus tools and is potentially invisible to the operating system. If a users device becomes infected with sinkclose-associated malware, it is virtually impossible to remove. Even formatting the hard drive and reinstalling the operating system will not get rid of the malware.
The vulnerability was reportedly discovered by Enrique Nissim and Krzysztof Okupski, researchers for the cybersecurity firm IOActive, and was disclosed at the Defcon hacker conference on Aug. 10.
According to a separate report from Toms Hardware, AMD has <a href="https://www.tomshardware.com/pc-components/cpus/amd-wont-patch-all-chips-affected-by-severe-data-theft-vulnerability-ryzen-1000-2000-and-3000-will-not-get-patched-among-others" target="_blank" rel="nofollow">released</a> mitigation patches for many of the processors affected, and the PCs affected are flagged to receive an update. However, some older models will not be patched at all, as they fall outside of the software support window. These processors include the Ryzen 3000 and older processors and Threadripper 2000 and older chips.
For crypto users, the sinkclose vulnerability could be especially concerning. It implies that if a device with an AMD processor is found to contain malware, formatting the hard drive and reinstalling the OS may not successfully remove it. In this case, a user should consider throwing away the device instead of attempting to clean it before installing a wallet.&nbsp;
For users who only do simple cryptocurrency transfers and do not use Web3 applications, using a hardware wallet may help mitigate the threat of Sinkclose-based malware. However, this is unlikely to help users who use Web3 applications, as these applications usually require users to blind sign or trust a PC to display transaction data since the data cannot be displayed on a hardware wallets LCD screen.
Given the threat from Sinkclose, users with AMD devices may want to check that their processor or graphics card firmware is updated to the latest version, as the company has announced that the latest patches contain mitigations against the vulnerability.
<h2 class="wp-block-heading" id="phish-of-the-week-web3-gamer-loses-69-000-in-tether">Phish of the week: Web3 gamer loses $69,000 in Tether</h2>
A Web3 gamer and memecoin trader lost over $69,000 worth of Tether (USDT) stablecoins from an approval phishing scam on Aug. 9.&nbsp;
At 10:33 pm UTC, the user&nbsp;<a href="https://etherscan.io/tx/0xe116d3504884b479e9be6d1d00976fc9541e836b7cc6aedccee91897067f383e" target="_blank" rel="nofollow">approved</a>&nbsp;a malicious account labeled Fake_Phishing401336 to spend all of their USDT. One minute after this approval, the attacker made two transfers from the victims account to other accounts. One of these transfers was for $58,702.42, while the other was for $10,359.25, for&nbsp;a total of $69,061.67.
Blockchain security platform Scam Sniffer detected the transactions and announced the attack on X.
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="751" height="824" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/scam-sniffer-usdt-phishing.jpg" alt="Scam Sniffer reports USDT phishing attack" class="wp-image-35105" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/scam-sniffer-usdt-phishing.jpg 751w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/scam-sniffer-usdt-phishing-273x300.jpg 273w" sizes="(max-width: 751px) 100vw, 751px">
 <figcaption class="wp-element-caption">
 (Scam Sniffer/X)
 </figcaption>
</figure>
In the past, the victim has traded Web3 gaming tokens such as Heroes of Mavia (MAVIA) and Immutable X (IMX), as well as memecoins like HarryPotterObamaSonic10Inu, MAGA (TRUMP), and Hemule. Other than these facts, not much is known about the victim.
Token approval phishing scams are a common way for Web3 users to lose their tokens. In such a scam, the attacker tricks the user into visiting a website that contains a malicious app. The app is usually disguised as one that the user trusts, such as a video game, NFT marketplace, or memecoin trading app that the user has visited in the past. But in fact, these apps usually reside at misspelled URLs and are not authorized by the company they are claiming to be made by.
When the user pushes a button on the malicious app, it pushes a token approval transaction to the users wallet. If the user confirms this approval, the attacker drains the victims wallet of whatever token was approved. In this case, the user lost over $69,000 thanks to the scam.
Web3 users are advised to carefully inspect both the URL and contract address of any website seeking token approval. This can potentially save users from costly losses.
Update 8:40 a.m. UTC on August 13, 2024: This article has been updated to include a comment from the iVest team.

Weird ‘null address’ iVest hack, millions of PCs still vulnerable to ‘Sinkclose’ malware: Crypto-Sec

Table of Contents

Cointelegraph

Other articles published on Aug 13, 2024

All the crypto news that you don’t see elsewhere

Spot Bitcoin ETFs see $27.87m inflows, outpacing Ethereum ETFs by wide margin

Cryptocurrency Market Faces Dramatic Declines

VALR CMO Highlights Emerging Markets’ Crypto Revolution at Foresight 2024 Hong Kong

U.S. PPI rises 0.1% in July as inflation slows further

Broadwind Inc. (BWEN) Beats Q2 EPS Expectations by $0.015

Join our free newsletter for daily crypto updates!