DeFi

Proxy

Zero

<p class="has-text-align-center"><em>Crypto scams, hacks and exploits and how to avoid them: Crypto-Sec</em></p>
<h2 class="wp-block-heading" id="phish-of-the-week-defi-saver-user-loses-55-million-in-dai">Phish of the Week: DeFi Saver user loses $55 million in DAI</h2>
<p>A user of decentralized finance management protocol DeFi Saver suffered an unusual style of phishing attack on Aug. 21. According to an X post from blockchain security firm Global Ledger, the attacker <a href="https://x.com/GlobalLedger/status/1826211670118609346" target="_blank" rel="nofollow">tricked</a> the user into reassigning ownership of their DeFi Saver Proxy contract. <br><br>The victim reportedly attempted to perform a transaction soon afterward, but it failed. The attacker then changed ownership again and drained the smart contract wallet of all of its Dai (DAI) stablecoin, removing over $55 million worth in total.</p>
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="757" height="730" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/DeFi-Saver-phishing-attack-Global-Ledger.png" alt="Global Ledger post to X about DeFi Saver phishing attack" class="wp-image-35465" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/DeFi-Saver-phishing-attack-Global-Ledger.png 757w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/DeFi-Saver-phishing-attack-Global-Ledger-300x289.png 300w" sizes="(max-width: 757px) 100vw, 757px">
 <figcaption class="wp-element-caption">
  <em>(Global Ledger)</em>
 </figcaption>
</figure>
<p>Blockchain data <a href="https://etherscan.io/tx/0xf70042bf3ae7c22f0680f8afa078c38989ed475dfbe5c8d8f30a50d4d2f45dc4" target="_blank" rel="nofollow">shows</a> that the DAI came from the null address rather than from the victims address, implying that the attacker must have minted the DAI using the victims collateral instead of directly draining it from the victims account.&nbsp;</p>
<p>The victims smart contract wallet is labeled DSProxy #166,776 on Etherscan. On Aug. 20, the account owner <a href="https://etherscan.io/tx/0xb721c8d603d5cbac826d804b04fb4662952afe91af15cf2aa603d002d3410b87" target="_blank" rel="nofollow">called</a> the Set Owner function and listed a malicious phishing account as the new owner. The owner was likely tricked by a malicious web app into approving this transaction. It was a costly mistake, as the victim is now $55 million poorer.</p>
<section class="adv-banner adbutler-ad adbutler-ad__desktop">
 <div class="container">
  <a href="https://servedbyadbutler.com/go2/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img decoding="async" src="https://servedbyadbutler.com/adserve/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img" alt="$55M DeFi Saver phish, copy2pwn hijacks your clipboard: Crypto Sec"></a>
 </div>
</section>
<section class="adv-banner adbutler-ad adbutler-ad__mobile">
 <div class="container">
  <a href="https://servedbyadbutler.com/go2/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img decoding="async" src="https://servedbyadbutler.com/adserve/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img" alt="$55M DeFi Saver phish, copy2pwn hijacks your clipboard: Crypto Sec"></a>
 </div>
</section>
<p>Web3 users should consider carefully inspecting contract addresses before approving transactions. Many protocols list their official contract addresses in their documents, and users can check these addresses to make sure the one they are about to interact with is listed there. This can often save users from losing funds due to phishing attacks, although no security method is 100% foolproof.</p>
<h2 class="wp-block-heading" id="defi-exploits-ivest-announces-shutdown-after-156k-lost">DeFi exploits: iVest announces shutdown after $156K lost</h2>
<p>Decentralized finance (DeFi) protocol iVestDAO announced that it will not be able to reopen after suffering from a $156,000 exploit. The protocol had previously stated that it would compensate investors and reopen at a later date. However, the iVests Telegram admin told Cointelegraph on Aug. 15 that it is shutting down.</p>
<p>Unfortunately, we are not able to continue operations and are shutting down the project and refunding our holders out of our own pockets, the admin stated, calling this development a tragic event.</p>
<p>In a public statement on the protocols website, iVest <a href="https://ivest.finance/" target="_blank" rel="nofollow">claimed</a> that the team is refunding our holders out of our own pockets. However, the totality of funds is not recoverable and there is no method to replace it back to 100% with the personal funds available to the team.</p>
<p>The team stated that it was hurt and defeated, but would pick up the pieces and move on with our lives.</p>
<p>iVest was exploited via a null address donation attack on Aug. 12.</p>
<h2 class="wp-block-heading" id="malware-corner-copy2pwn-bypasses-windows-smart-screen">Malware Corner: Copy2pwn bypasses Windows Smart Screen</h2>
<p>A new exploit, called copy2pwn, is being used by malware operators to bypass protections in the Windows Smart Screen program, according to a report from SecurityWeek. The vulnerability has been <a href="https://www.securityweek.com/copy2pwn-zero-day-exploited-to-bypass-windows-protections/" target="_blank" rel="nofollow">patched</a> in the latest version of Windows, but some devices may not have been updated yet and may still be at risk.</p>
<p>The exploit could potentially be used to install malware, leading to the loss of private keys in software wallets.</p>
<div class="article-suggest"> 
 <div class="article-suggest__title display3">
  Read also
 </div> 
 <div class="article-suggest__items"> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/can-you-trust-crypto-exchanges-after-the-collapse-of-ftx/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Can you trust crypto exchanges after the collapse of FTX?</p> </a> 
  </div> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/crypto-market-makers-legit-dodgy-fake-it/" class="article-suggest__subtitle display4"> <span>Features</span> <p>What do crypto market makers actually do? Liquidity, or manipulation</p> </a> 
  </div>
 </div>
</div>
<p>Copy2pwn was <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-38213" target="_blank" rel="nofollow">disclosed</a> in CVE-2024-38213 and reportedly discovered by Trend Micros Zero Day Initiative. It utilizes the Web-based Distributed Authoring and Versioning (WebDAV) protocol in Windows, which is intended to make it easier for users to share and edit web-based content. </p>
<p>However, cybercriminals discovered that the content hosted on WebDAV shares was failing to gain a Mark of the Web flag, allowing it to bypass Smart Screen protections.</p>
<p>According to the report, malware operators have been using copy2pwn to install DarkGate on users devices. DarkGate is a sophisticated malware program that is difficult to detect and efficient at <a href="https://socradar.io/darkgate-malware-exploring-threats-and-countermeasures/" target="_blank" rel="nofollow">stealing</a> data, according to cybersecurity firm Socradar.</p>
<p>Crypto users who rely on Windows Smart Screen for malware protection should consider upgrading to the latest version of Windows as soon as possible.</p>
<h2 class="wp-block-heading" id="clipboard-hijacking-hits-hackathon-participant">Clipboard hijacking hits hackathon participant</h2>
<p>Porter Adams, software engineer for ZKsync network developer Matter Labs, ran across crypto-stealing malware in an unusual place on Aug. 25; on the PC of a fellow hackathon participant.</p>
<p>Adams posted a video of the reported incident on X.</p>
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="663" height="910" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/crypto-hijacking-porter.png" alt="Porter Adams post to X about clipboard hijacking malware" class="wp-image-35466" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/crypto-hijacking-porter.png 663w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/08/crypto-hijacking-porter-219x300.png 219w" sizes="(max-width: 663px) 100vw, 663px">
 <figcaption class="wp-element-caption">
  Source: Porter Adams.
 </figcaption>
</figure>
<p>The participant was attempting to send Ether (ETH) on the Sepolia test network to a particular address. However, Adams discovered that the persons device was infected with clipboard-hijacking software. </p>
<p>Whenever the user attempted to copy and paste a crypto address, the malware would paste its developers address instead, causing the user to send crypto to the wrong address and lose it forever.</p>
<p>Luckily, the participants were using a testnet with ETH that had no real value. But had the participant gone home and made real crypto transactions with this device, they could have easily lost all of their funds. I saved a hackathon participant from malware today, Adams stated in his post.</p>
<p>When cutting and pasting addresses, crypto users are advised to check the address pasted to make sure it is the same as the one they intended to copy. If it turns out to be a different address, the device may be infected.</p>
<div class="subscribe subscribe--inner">
 <div class="container">
  <div class="subscribe__inner">
   <div class="subscribe__content"> 
    <div class="subscribe__title display2">
     Subscribe
    </div> 
    <div class="subscribe__desc text-l">
     The most engaging reads in blockchain. Delivered once a week.
    </div> 
    <div class="wpcf7 no-js" id="wpcf7-f13672-o1" lang="en-US" dir="ltr">
     <div class="screen-reader-response">
      <p role="status" aria-live="polite" aria-atomic="true"></p> 
      <ul></ul>
     </div>
     <form action="/magazine/wp-json/wp/v2/posts?_embed&amp;per_page=100#wpcf7-f13672-o1" method="post" class="wpcf7-form init subscribe__form demo" aria-label="Contact form" novalidate data-status="init">
      <div style="display: none;">
       <input type="hidden" name="_wpcf7" value="13672">
       <input type="hidden" name="_wpcf7_version" value="5.7.7">
       <input type="hidden" name="_wpcf7_locale" value="en_US">
       <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f13672-o1">
       <input type="hidden" name="_wpcf7_container_post" value="0">
       <input type="hidden" name="_wpcf7_posted_data_hash" value="">
      </div>
      <fieldset class="form-group">
       <p><input size="40" class="wpcf7-form-control wpcf7-text wpcf7-email wpcf7-validates-as-required wpcf7-validates-as-email" id="footer-subscribe" aria-required="true" aria-invalid="false" value="" type="email" name="your-email"><label for="footer-subscribe">Email address</label></p>
      </fieldset>
      <p><button class="subscribe__btn btn btn-white">SUBSCRIBE</button></p>
      <div class="wpcf7-response-output" aria-hidden="true"></div>
     </form>
    </div>
   </div>
   <div class="subscribe__img"> 
    <img decoding="async" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2022/10/reading-copy.png" alt="Subscribe to Magazine by Cointelegraph Newsletter.">
   </div>
  </div>
 </div>
</div>

$55M DeFi Saver phish, copy2pwn hijacks your clipboard: Crypto Sec

Table of Contents

Cointelegraph

Other articles published on Aug 26, 2024

Crypto investment products see largest inflows in 5 weeks

Tokenized T-Bills issuer OpenEden surpasses $100m in TVL

What is the Recent Paradigm-Funded Reddio Network?

XRP Finally Loses $0.60 Price Threshold: What's Next?

Magic Eden Announces Official Ecosystem Token, ME

Bitcoin Hangs on Critical Support: Will BTC Price Rise to $66,000 or Face a Rejection to $60,000?

Join our free newsletter for daily crypto updates!