crypto sec

Bankroll Network is reportedly drained of $230,000 through a loan exploit, while a phishing scammer used CoW protocol for laundering.

According to a Sept. 23 X post from blockchain security platform TenArmor, a hacker attacked the decentralized finance protocol Bankroll Network on Sept. 22, draining $230,000 from it.

TenArmor posted an image of the attack transactions. It shows numerous transfers of BNB from a BankrollNetworkStack contract to itself, each worth $9,679,645.51.

Two other transfers are for $9,435,877.94, one of which comes from a PancakeSwap exchange pool and is sent to an account ending in 47D7, while the other comes from the 47D7 account and is sent to the BankrollNetworkStack contract. 

Read more

A DeFi Saver user fell victim to a novel phishing attack, and a clipboard hijacker discovered at hackathon, plus new windows vulnerability

Crypto scams, hacks and exploits and how to avoid them: Crypto-Sec

A user of decentralized finance management protocol DeFi Saver suffered an unusual style of phishing attack on Aug. 21. According to an X post from blockchain security firm Global Ledger, the attacker tricked the user into reassigning ownership of their DeFi Saver Proxy contract.

The victim reportedly attempted to perform a transaction soon afterward, but it failed. The attacker then changed ownership again and drained the smart contract wallet of all of its Dai (DAI) stablecoin, removing over $55 million worth in total.

Blockchain data shows that the DAI came from the null address rather than from the victims address, implying that the attacker must have minted the DAI using the victims collateral instead of directly draining it from the victims account. 

Read more

iVest hit with “null address” exploit, millions of PCs at risk to “un-removable” malware, Web3 gamer tricked into $69K approval: Crypto-Sec.

Crypto scams, hacks and exploits and how to avoid them: Crypto-Sec

Decentralized Finance protocol iVest Finance was the victim of a $156,000 exploit on Aug. 12, according to a report from blockchain security firm QuillAudits.

Transferring tokens to a null address (0x0) usually causes them to be lost forever. However, in the iVest protocol, transfers to the null address cause a _MakeDonation function to be called, which in turn causes the senders balance [to be] incorrectly reduced by double the intended amount, QuillAudits reported.

Read more