Bankroll Network

DeFi

when

<h2 class="wp-block-heading">DeFi exploits: Bankroll is reportedly drained of $230,000<p>According to a Sept. 23 X post from blockchain security platform TenArmor, a hacker attacked the decentralized finance protocol Bankroll Network on Sept. 22, draining $230,000 from it.</p><p>TenArmor <a href="https://x.com/TenArmorAlert/status/1838045254899159055" target="_blank" rel="nofollow">posted</a> an image of the attack transactions. It shows numerous transfers of BNB from a BankrollNetworkStack contract to itself, each worth $9,679,645.51.</p><p>Two other transfers are for $9,435,877.94, one of which comes from a PancakeSwap exchange pool and is sent to an account ending in 47D7, while the other comes from the 47D7 account and is sent to the BankrollNetworkStack contract.&nbsp;</p><p>The difference between the self-transfers and the transfer to the account is $243,767.57, which is approximately equal to the $235,000 stated as the loss amount.</p><p>Given this information, the attacker may have exploited a vulnerability that allowed them to withdraw more than they deposited and used flash loans to make the initial deposit.</p>
 <figure class="wp-block-image aligncenter size-large">
  <img decoding="async" width="1024" height="299" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/TenArmor-Bankroll-transactions-1024x299.png" alt="Reported Bankroll attack transactions" class="wp-image-36185" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/TenArmor-Bankroll-transactions-1024x299.png 1024w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/TenArmor-Bankroll-transactions-300x88.png 300w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/TenArmor-Bankroll-transactions-770x225.png 770w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/TenArmor-Bankroll-transactions.png 1535w" sizes="(max-width: 1024px) 100vw, 1024px">
  <figcaption class="wp-element-caption">
   <em>Bankroll Network attack transactions. (TenArmorAlert)</em>
  </figcaption>
 </figure><p>Blockchain data <a href="https://bscscan.com/tx/0xd4c7c11c46f81b6bf98284e4921a5b9f0ff97b4c71ebade206cb10507e4503b0" target="_blank" rel="nofollow">confirms</a> that the transfers happened at 4:50 pm UTC on Sept. 22. Cointelegraph contacted the Bankroll Network team via Telegram but did not receive a response by the time of publication.</p><p>DeFi exploits are a frequent cause of losses to Web3 users. Users should carefully research a protocols security before using it. Protocols that are audited by reputable smart contract security firms are more likely to be secure, although this cannot 100% guarantee that vulnerabilities dont exist.</p>
 <section class="adv-banner adbutler-ad adbutler-ad__desktop">
  <div class="container">
   <a href="https://servedbyadbutler.com/go2/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img decoding="async" src="https://servedbyadbutler.com/adserve/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img" alt="​​Bankroll Network DeFi hacked, $50M phisher moves crypto on CoW: Crypto-Sec"></a>
  </div>
 </section>
 <section class="adv-banner adbutler-ad adbutler-ad__mobile">
  <div class="container">
   <a href="https://servedbyadbutler.com/go2/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img decoding="async" src="https://servedbyadbutler.com/adserve/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img" alt="​​Bankroll Network DeFi hacked, $50M phisher moves crypto on CoW: Crypto-Sec"></a>
  </div>
 </section><p>Bankroll Network has not confirmed that this transaction is an exploit, and security researchers may report new information about it as their investigations continue. This is a developing story and may be updated over time.</p></h2>
<h2 class="wp-block-heading" id="phish-of-the-week-phisher-moved-250-000-through-cow">Phish of the week: Phisher moved $250,000 through CoW</h2>
<p>On Aug. 28, a phishing attacker who previously drained a crypto whales wallet of $55.4 million moved some of the stolen loot through the CoW decentralized finance protocol in an attempt to launder it, according to blockchain security platform PeckShield. </p>
<p>In the process, the attacker converted the stolen DAI stablecoin to ETH. The platform detected the transaction on Sept. 14 when the attacker transferred the ETH to a new address.</p>
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="658" height="476" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/peck-shield-phishing-attacker-laundering.png" alt="Tweet from PeckShield regarding whale phisher" class="wp-image-36187" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/peck-shield-phishing-attacker-laundering.png 658w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/peck-shield-phishing-attacker-laundering-300x217.png 300w" sizes="(max-width: 658px) 100vw, 658px">
 <figcaption class="wp-element-caption">
  <em>(PeckShield)</em>
 </figcaption>
</figure>
<p>When displayed on Etherscan, the alleged money laundering transaction is shown in a list of 33 individual trades that were performed as part of a MoooZ1089603480 function call. The account labeled Fake_Phishing442897 sent $260,000 worth of DAI stablecoin to CoW and received approximately 106.29 ETH in exchange.</p>
<figure class="wp-block-image aligncenter size-large">
 <img decoding="async" width="1024" height="447" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/phishing-cow-protocol-money-laundering-1024x447.png" alt="Whale phisher money laundering transactions on Etherscan" class="wp-image-36188" srcset="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/phishing-cow-protocol-money-laundering-1024x447.png 1024w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/phishing-cow-protocol-money-laundering-300x131.png 300w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/phishing-cow-protocol-money-laundering-770x336.png 770w, https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2024/09/phishing-cow-protocol-money-laundering.png 1358w" sizes="(max-width: 1024px) 100vw, 1024px">
 <figcaption class="wp-element-caption">
  <em>Phishing attacker alleged money laundering transaction. (Etherscan)</em>
 </figcaption>
</figure>
<p>The function was called by what appears to have been a third-party paymaster account or relayer. By having a third-party call the function, the attacker may have hoped to fool analytics systems and prevent the funds from being traced; however, the strategy failed.</p>
<p>The alleged attacker received $3,000 worth of the DAI on the previous day, which they had obtained by swapping ETH through CoW.&nbsp;</p>
<p>Going further back through time, they had originally <a href="https://etherscan.io/tx/0x7c6305d30fbc9f9a94749750967ac54d7fced0d3bea5ea4d370d92514ed07802" target="_blank" rel="nofollow">received</a> some of the ETH on Aug. 20. At that time, they received 3,879.58 ETH (approximately $10,000,000 based on the price of ETH at the time) from CoW, which they obtained by trading DAI for it. The ETH was then sent through several intermediate addresses before arriving at the address that was later detected by PeckShields system.</p>
<div class="article-suggest"> 
 <div class="article-suggest__title display3">
  Read also
 </div> 
 <div class="article-suggest__items"> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/cleaning-crypto-how-much-enforcement-needed/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Cleaning up crypto: How much enforcement is too much?</p> </a> 
  </div> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/blockchain-preserve-heritage-marshall-islands/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Extinct or Extant: Can Blockchain Preserve the Heritage of Endangered Populations?</p> </a> 
  </div>
 </div>
</div>
<p>According to PeckShield, the funds can ultimately be traced back to a $55.4-million phishing attack against a large account or whale.</p>
<p>A phishing attack is a type of scam that involves tricking a person into giving away sensitive information or performing an action that the scammer desires. In the context of cryptocurrency, it usually involves tricking a user into authorizing token approvals. Once the victim makes these token approvals, the attacker uses them to drain the victims wallet.</p>
<p>Crypto users should inspect the addresses they interact with carefully. If a user accidentally approves a malicious contract to transfer their tokens, they can easily lose their funds to an attacker. This particular victims funds are being split between different wallets and swapped for other tokens in a seemingly endless attempt to evade analytics programs. If the attacker manages to confuse the programs well enough, they may even be able to safely transfer the funds to a centralized exchange and cash out, at which point the money will probably be lost forever.</p>
<p>Luckily, security firms have been able to track the funds so far, and there is still some hope that authorities may eventually be able to recover them.</p>
<h2 class="wp-block-heading" id="malware-corner-d-link-discloses-telnet-vulnerabilities">Malware corner: D-Link discloses Telnet vulnerabilities</h2>
<p>Networking device manufacturer D-Link disclosed five vulnerabilities in some of its router models on Sept. 16, according to cybersecurity firm CyberRisk Alliance. These vulnerabilities could allow attackers to gain access to a users home network and, potentially, devices holding their crypto wallets.</p>
<p>The first two vulnerabilities, named CVE-2024-45695 and CVE-2024-45694, <a href="https://www.scmagazine.com/news/d-link-patches-5-vulnerabilities-including-rce-hard-coded-credential-flaws" target="_blank" rel="nofollow">allow</a> attackers to use a stack-based overflow to gain access to a router, at which point they can execute arbitrary code on the device, according to a report from cybersecurity firm CyberRisk Alliance. The first vulnerability only affects the DIR-X4860 and DIR-X5460 router models, whereas the second affects the DIR-X5460 alone.</p>
<p>The three other vulnerabilities affect the aforementioned DIR-X4860 as well as the discontinued COVR-X1870. These devices allow hardcoded credentials to be used to log in, as long as Telnet is enabled.&nbsp;</p>
<p>Under normal circumstances, an attacker should not be able to activate Telnet on the device. However, the vulnerability identified as CVE-2024-45697 allows an attacker to activate Telnet service on the device whenever the internet or WAN port is plugged into the modem. This means that the attacker can log in and start executing operating system (OS) commands.</p>
<p>The final two vulnerabilities, CVE-2024-45696 and CVE-2024-45698, also allow an attacker to use Telnet to log in and execute OS commands. With CVE-2024-45696, the attacker can send specific packets to force Telnet to become enabled, although this particular vulnerability can only be exploited by someone who already has access to the WiFi network the device is operating on. With CVE-2024-45698, the attacker can bypass user input validation in the Telnet service, allowing them to inject OS commands.</p>
<p>D-Link has urged its users to upgrade their devices to the latest firmware to protect themselves against any attacks stemming from these vulnerabilities.</p>
<p>Crypto wallet users should take extra care to ensure their home network is not vulnerable to an attack. Cybercriminals can use a home network breach to monitor a crypto users online behavior, which may then be used to plan further attacks that ultimately result in the loss of crypto funds.</p>
<div class="subscribe subscribe--inner">
 <div class="container">
  <div class="subscribe__inner">
   <div class="subscribe__content"> 
    <div class="subscribe__title display2">
     Subscribe
    </div> 
    <div class="subscribe__desc text-l">
     The most engaging reads in blockchain. Delivered once a week.
    </div> 
    <div class="wpcf7 no-js" id="wpcf7-f13672-o1" lang="en-US" dir="ltr">
     <div class="screen-reader-response">
      <p role="status" aria-live="polite" aria-atomic="true"></p> 
      <ul></ul>
     </div>
     <form action="/magazine/wp-json/wp/v2/posts?_embed&amp;per_page=100#wpcf7-f13672-o1" method="post" class="wpcf7-form init subscribe__form demo" aria-label="Contact form" novalidate data-status="init">
      <div style="display: none;">
       <input type="hidden" name="_wpcf7" value="13672">
       <input type="hidden" name="_wpcf7_version" value="5.7.7">
       <input type="hidden" name="_wpcf7_locale" value="en_US">
       <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f13672-o1">
       <input type="hidden" name="_wpcf7_container_post" value="0">
       <input type="hidden" name="_wpcf7_posted_data_hash" value="">
      </div>
      <fieldset class="form-group">
       <p><input size="40" class="wpcf7-form-control wpcf7-text wpcf7-email wpcf7-validates-as-required wpcf7-validates-as-email" id="footer-subscribe" aria-required="true" aria-invalid="false" value="" type="email" name="your-email"><label for="footer-subscribe">Email address</label></p>
      </fieldset>
      <p><button class="subscribe__btn btn btn-white">SUBSCRIBE</button></p>
      <div class="wpcf7-response-output" aria-hidden="true"></div>
     </form>
    </div>
   </div>
   <div class="subscribe__img"> 
    <img decoding="async" src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2022/10/reading-copy.png" alt="Subscribe to Magazine by Cointelegraph Newsletter.">
   </div>
  </div>
 </div>
</div>

Bankroll Network DeFi hacked, $50M phisher moves crypto on CoW: Crypto-Sec

Table of Contents

Cointelegraph

Other articles published on Sep 23, 2024

Binance Super Earn Welcomes Hamster Kombat Token!

Neiro, Immutable X, Arkham pumps as Bitcoin stalls

Bitcoin’s Next Contender? This Altcoin Could See a 30,000% Rise by 2025!

NiceHash Docker Miner Integrates with Vast.ai to Monetize Idle GPUs

Why Intel’s Stock (INTC) is Gaining in Premarket Trading Today

Coinbase to Integrate Wrapped Bitcoin Token with Solana Blockchain

Join our free newsletter for daily crypto updates!