BlockThreat - Week 47, 2021
Wanaka | Unlock | Olympus | Ploutoz | Level | dYdX | Wolf | Snowdog
Welcome to BlockThreat!
What a crazy week. Seven different DeFi incidents with more than $13M lost to hacks, samczsun helps rescue another project, $10M+ rugpulls, malware campaigns targeting the crypto ecosystem, all the while multi-million databases of PII continue getting leaked to further fuel the phishing machine. In other news, Kazakhstan’s power grid is in trouble after a rapid increase in crypto mining operations. Let’s dive right in, but first be sure to check out Donjon CTF which is kicking off tonight!
Google CAT published a Threat Horizons intelligence report revealing the latest in phishing and other malicious campaigns including increased use of compromised Google Cloud for cryptomining.
Safe thieves offered a $500K reward to return a safe with locked cryptocurrency keys.
Donjon 2021 CTF starts on November 30th.
Phantom Galaxies fell victim to another Discord channel takeover which cost its customers $1.1M lost to a fake airdrop.
On November 11, 2021 Wanaka Farm lost $1m as a result of a race condition with a backend API.
On November 21, 2021 Unlock Protocol lost $9.7M worth of UDT after a private key compromise used on xDAI and Polygon networks.
On November 22, 2021 OlympusDAO lost $1.43M as a result of a vulnerability in its bond contract.
On November 23, 2021 Ploutoz Finance was exploited with an oracle price manipulation exploit which resulted in the theft of $365K worth of tokens.
On November 26, 2021 Lever Network lost $650K due to insufficient checks in liability calculation.
On November 27, 2021 dYdX performed a self hack with the help of samczsun to rescue potentially vulnerable funds.
Enzyme Finance patched a critical price oracle manipulation vulnerability after it was responsibly disclosed by setuid0 using Immunefi platform.
Geth published details of the CVE-2021-41173 DoS vulnerability which could crash the node using a specially crafted message.
Morphisec report on Babadeda malware targeting Crypto, DeFi, and NFT communities primarily through Discord phishing campaigns and typosquatting domains.
Ethereum analytics with BigQuery by Nick Johnson.
The Solcurity Standard for smart contract auditing by transmissions11.
Price Manipulation Attacks From First Principles with Tincho.
Storage slot discovery technique by banteg.
Debugging with dapptools and local nodes by Matt Solomon.
Wanaka Farm Attacker: