Ethereum

Penpie

According to PeckShield’s monitoring statistics, in August 2024, over 10 hacking incidents occurred in the crypto sector, resulting in a loss of approximately $313.86 million. The two largest hacks involved unauthorized transfers (phishing), accounting for 93.5% of the total stolen funds, amounting to $293.4 million.Top 5 hacking incidents in August:Phishing: $238 million (BTC)Phishing: $55.4 million (DAI)Ronin: $12 million (recovered)Unauthorized transfer: $5.1 millionNexera: $1.83 million<img src="https://klteeqb691.feishu.cn/space/api/box/stream/download/asynccode/?code&#61;YjA1YzVhNGZlYmQ4M2QzZDhiZGFhNDFmMDhiZTg4MmZfUUlvd3Y5MnFDaUNEM1kwRGprdVFQUFk4WkxlN0lxOGdfVG9rZW46TDJ2UmJmNWlab2pnaWp4ZE9odWNrRm9tbnFjXzE3MjU0NDE0NTU6MTcyNTQ0NTA1NV9WNA" />The data shows that the average monthly stolen funds in the crypto sector exceeded $200 million this year.<h2 id="header-0">First Major Hack in September: Penpie Attack</h2>According to Beosin Alert, the DeFi protocol Penpie, built on Pendle, suffered a hack resulting in the theft of approximately $27 million in crypto assets. Beosin’s analysis revealed that the attacker exploited the claimRewards function in the market contract, using a reentrancy attack to inflate the staking contract balance and extract surplus staked assets.Summary of the attack process:1. The attacker created an attack contract and built the corresponding market contract via the official factory.2. The attacker called the batchHarvestMarketRewards function to update market rewards.3. During the reward update, the claimRewards function was called back, allowing the attacker to stake flash-loaned assets, creating a discrepancy in the staking contract and extracting the surplus.4. The attacker withdrew the staked assets and repaid the flash loan for profit.<img src="https://klteeqb691.feishu.cn/space/api/box/stream/download/asynccode/?code&#61;N2E0NDVlYzVmNDVlZWZhODQwNjZkNjU3NWY5MjMwZTBfNVV1RkxTcTByc0hwWnk5WEs5alpnQkwyMjZzVWJtbkxfVG9rZW46VXNZSmJJQ01xbzc5RU54WWFLM2NpaFFxbktjXzE3MjU0NDE0NTU6MTcyNTQ0NTA1NV9WNA" />Most of the stolen assets were Ethereum derivatives (e.g., wstETH, agETH, rswETH). The attacker converted the bulk of the stolen assets into 11,109 ETH ($26.95 million), with 1,000 ETH ($2.42 million) laundered through Tornado Cash. The initial funds used by the attacker were also traced back to Tornado Cash, making it difficult to identify the source.The stolen assets, aside from the 1,000 ETH already laundered, are stored at the following addresses:<ul><li>0x7a2f4d625fb21f5e51562ce8dc2e722e12a61d1b (holding YT assets worth $0.85 million)</li><li>0x2f2dDE668e5426463E05D795f5297dB334f61C39 (holding 10,113 ETH)</li></ul>The Penpie team has left messages on-chain, requesting communication with the hacker and offering not to pursue legal action if the funds are returned, though there has been no progress so far. Seven hours after the attack was detected, Pendle successfully patched the vulnerability.<img src="https://klteeqb691.feishu.cn/space/api/box/stream/download/asynccode/?code&#61;MzdhYjNhOWRjMjUxMmEwOGMyM2E0MTg0OTE4YjZmYjFfZGpFZVFFakpRNmdSWlIyTzBRbzF2bUdhOTJuM0dIWnlfVG9rZW46TWM5Y2JxRGlIbzM5Qnp4bzBpb2NYVUpNbnBiXzE3MjU0NDE0NTU6MTcyNTQ0NTA1NV9WNA" />Pendle stated, “In response to the security breach, we swiftly paused our contracts, effectively protecting around $105 million.” The Pendle contracts have since resumed normal operations.<h2 id="header-1">FBI Exposes North Korean Attacks on Crypto DeFi Through Social Engineering</h2>On September 3, 2024, the FBI issued a warning, highlighting that North Korean hackers are increasingly targeting the cryptocurrency industry, particularly DeFi companies. These attacks utilize advanced social engineering techniques, such as thorough research on victims through social media and job platforms, to create convincing lures like job offers and investment proposals. The hackers build trust over time before eventually sending malicious software to steal crypto assets.The FBI confirmed that these hackers use fake GitHub profiles and forged national identities to craft highly personalized fake identities, gaining employment within crypto companies. Once inside, they deploy malware to attack the company’s assets. The FBI advises crypto companies to remain vigilant when verifying identities, record all interactions with potential attackers, and report any suspicious activity to law enforcement. As North Korean tactics continue to evolve, individuals and companies in the crypto industry should be cautious about the information they share on social media.In summary, the increasing frequency of hacking incidents and the evolution of attack techniques underscore the ongoing critical importance of security in the crypto and blockchain sectors.

The Crypto Hack Storm: Massive Funds Stolen and North Korean Attack Tactics Evolving

Table of Contents

WikiBit Official

Other articles published on Sep 4, 2024

Russia Plans New Crypto Exchanges and Stablecoin Linked to RMB and BRICS Basket

Coinbase Announces It Will Support This Altcoin’s Update and Relist It

Solana in Crisis: Will the Meme Coin Bubble Burst SOL’s Future?

Telegram CEO Pavel Durov Released on €5M Bail Amid Serious Charges

ICONOMI: Bridging the Gap Between Traditional and Crypto Investing

Crypto Crash Today: Major Altcoins Plunge Amid Market Turmoil

Join our free newsletter for daily crypto updates!