Curve Finance exploit: Experts dissect what went wrong

August 10, 2022 Coin Telegraph

Attackers who hijacked Curve Finance’s landing page moved quickly to convert stolen funds to various tokens through different exchanges, wallets and mixers.

Decentralized finance protocols continue to be targeted by hackers, with Curve Finance becoming the latest platform to be compromised after a domain name system (DNS) hijacking incident.

The automated market maker warned users not to use the front end of its website on Tuesday after the incident was flagged online by a number of members of the wider cryptocurrency community.

While the exact attack mechanism is still under investigation, the consensus is that attackers managed to clone the Curve Finance website and rerouted the DNS server to the fake page. Users who attempted to make use of the platform then had their funds drained to a pool operated by the attackers.

Curve Finance managed to remedy the situation in a timely fashion, but attackers still managed to siphon what was originally estimated to be $537,000 worth of USD Coin (USDC) in the time it took to revert the hijacked domain. The platform believes its DNS server provider Iwantmyname was hacked, which allowed the subsequent events to unfold.

Cointelegraph reached out to blockchain analytics firm Elliptic to dissect how attackers managed to dupe unsuspecting Curve users. The team confirmed that a hacker had compromised Curve’s DNS, which led to malicious transactions being signed.

Elliptic estimates that 605,000 USDC and 6,500 Dai was stolen before Curve found and reverted the vulnerability. Utilizing its blockchain analytics tools, Elliptic then traced the stolen funds to a number of different exchanges, wallets and mixers.

The stolen funds were immediately converted to Ether (ETH) to avoid a potential USDC freeze, amounting to 363 ETH worth $615,000.

Interestingly, 27.7 ETH was laundered through the now United States Office of Foreign Assets Control-sanctioned Tornado Cash. 292 ETH was sent to the FixedFloat exchange and coin swap service. The platform managed to freeze 112 ETH and confirmed the movement of funds, according to an Elliptic spokesperson:

“We have been in contact with the exchange, which confirmed a further three addresses that the hacker withdrew funds into from the exchange (these were completed orders that FixedFloat were not able to freeze in time). These include 1 BTC address, 1 BSC Address and 1 LTC address.”

Elliptic is now monitoring these flagged addresses in addition to the original Ethereum-based addresses. A further 20 ETH was sent to a Binance hot wallet, and another 23 ETH was moved to an unknown exchange hot wallet.

Elliptic also cautioned the wider ecosystem of further incidents of this nature after identifying a listing on a darknet forum claiming to sell “fake landing pages” for hackers of compromised websites.

It is unclear whether this listing, which was discovered just a day before the Curve Finance DNS hijacking incident, was directly related, but Elliptic noted it highlights the methodologies used in these types of hacks.

Onchain Analysis Report Says Terra’s Bitcoin Reserves Were Sent to Binance and Gemini

May 15, 2022 Bitcoin.com

Three-quarters of BTC addresses still in profit despite market decline: Glassnode

April 12, 2022 Coin Telegraph

Bear Market

The report by Glassnode also revealed that up to 60% of the transaction volume is in what it calls “profit dominance”, and long-term holders are the most likely to be in the green.

The price of Bitcoin (BTC) has been on the decline again recently, but new insights from blockchain analytics firm Glassnode show that up to 75% of Bitcoin addresses are in profit.

In its Week-On Chain report published on Monday, April 11, Glassnode analyzed the number of Bitcoin wallets that are in profit and found that around 70% to 75% of addresses are seeing an unrealized profit, much higher than the 45% to 50% of addresses during the 2018 bear market.

Commenting on the findings, the Glassnode analysts added that the current bear market is nowhere near as bad as previous ones:

“The current bear market is not as severe as the worst phases of all prior cycles, with just 25% to 30% of the market being at an unrealized loss. It remains to be seen if further sell-side pressure will drive the market lower, and thus pull more of the market into an unrealized loss like prior cycles.”

The report further revealed that long-term holders of Bitcoin, those who have held for over 155 days, were the least likely to be at a loss. More than 67.5% of long-term holders are at an unrealized profit, whereas short-term holders, those who have held for less than 155 days, have seen only 7.88% make any gains.

Currently, the Bitcoin price is below $40,000 and dipped close to $39,000 in the last 24 hours, which has placed the asset back into bear market territory. The direction in which Bitcoin will head has some speculating a drop to $30,000, whilst other data shows traders attempting to push the price to $50,000.

The report also detailed that 58% of the volume on the Bitcoin network is in what it terms “profit dominance”, a metric that hasn’t been strongly observed since December 2021.

Glassnode added that bear markets typically see long periods of transaction volume that make a loss, and this reversal to profit dominance could be a sign that sentiment is shifting, with demand for Bitcoin able to buy the sell-side.

However, Glassnode writes, “given prices continue to struggle, it does suggest that the demand side remains somewhat lackluster and that investors are taking profits into whatever market strength can be found.”

The analysts added that the market has seen daily realized profits of around 13,300 BTC since mid-February whilst daily realized losses declined from around 20,000 BTC in January, to around 8,300 BTC last week.

Whilst a large proportion of addresses and transactions see a profit, overall the amount of users on the Bitcoin network, and subsequently, the amount of transactions, is continuing to “languish” according to the analysts.

Transactions on the network are at around 225,000 daily transactions, a number similar to the 2018 to 2019 bear market. Transactions have climbed from mid-2021 but the analysts noted that “it is a far cry from the hype cycle observed during bull markets.”