2020-9-14 14:30 |
Hackers were able to infiltrate the DeFi lending protocol bZx and stole more than $8 million worth of cryptocurrencies. This is not the first time the DeFi protocol has been attacked this year.
This time, the hackers were 8 times more potent than the previous attack on the margin and leverage-based trading and lending platform. The hackers leveraged a duplication vulnerability that gave them access to siphon USDC, USDT, ETH, and LINK, with a combined worth of over $8 million.
Anton Bukov, a team member of the bZx group shared a thread on Twitter to admit that the firm was hit by another attack. He also said the hacking was initiated due to the fault in the line of code for a smart contract. The hacking was successful after the hackers initiated the iToken transactions to siphon ETH.
We realized that initial source code works incorrectly when "_from" equals to "_to" and leads to funds duplication. We found 9 exploiting transactions on $iETH lending token with 101778 $iETH tokens duplicated (worth ~4.7K $ETH) // @DuneAnalytics pic.twitter.com/IWodBkGaEq
— Anton Bukov | k06a.eth (@k06a) September 13, 2020 How the attack occurredWhen researchers delved deeper to find out how the hackers were able to infiltrate the DeFi protocol again, the report showed that there was a vulnerability in the “transferfrom0 protocol”, which allowed the successful transfer of ERC20 between protocols.
This made it easier to initiate the function when creating and transferring the iToken, giving the hackers the avenue to increase their balance. The hackers were able to initiate a transfer function using the same form & to address of the main function. Immediately after that, they used an InternalTransferFrom function with a single argument, allowing the lines to code faulty.
Subsequently, the hackers were able to increase the balance of –balancesTo while reducing the –balancesFrom, based on the report. After stealing $8 million from the DeFi protocol, the bZx hackers immediately patched the faulty code. After code coding companies Peckshield and Certik approved, the DeFi lending protocol decided to patch the code.
This is not the first time bZx has been attackedWith this recent spate of attacks, it seems bZx is facing a hard time this year. Based on an earlier report, a hacker successfully stole $1 million worth of ETH from the portal in two successful attempts in February.
In the first attack that occurred on February 14, the hacker made use of different methods in the attacks. First, the hacker took 10,000 ETH from dYdX and took a 112 wBTC loan on compound using 5,500 ETH.
In the second attack, which occurred four days later, the attacker drained the system off $600,000 by leveraging ‘oracle manipulation’ to cheat the system.
The post Hackers steal $8 million worth of cryptocurrencies from DeFi Protocol bZx appeared first on Invezz.
Similar to Notcoin - TapSwap on Solana Airdrops In 2024
Defi (DEFI) на Currencies.ru
|
