The Resurgence of DeFi Exploits Could Steer Crypto Hacking Activity Beyond Last Year’s Peak

Last Wednesday, one-stop digital assets management and fiat-based neo-banking services provider Blockbank teased the introduction of Avalanche support on its CeFi and DeFi -encompassing platform with a new V3 update. Blockbank V3 rolled out on Monday this week, bringing speed and stability improvements and user access to protocols/assets native to the Avalanche blockchain.

Blockbank partnered with several teams for the offering, including USD coin issuer Circle, blockchain intelligence and analytics platform Chainalysis, and NFT domain provider Unstoppable. The new release – the biggest update for the consumer-facing application – features a revamped design and focuses on helping users better interact with their digital assets. Users will benefit from a faster KYC platform, better calculation of transit fees, and swaps for the ETH, AVAX, and BNB tokens. Blockbank’s head of marketing highlighted improved security as another development.

October sees a surge in hacking activity

The integration is one of the many witnessed in the blockchain space recently, driving up the popularity of the decentralized finance (DeFi) niche. Notwithstanding this boom, the wider cryptocurrency sector has remained vulnerable and exposed to various forms of attacks by malicious actors. In a status update shared on Oct. 13, intelligence and risk management firm Chainalysis noted that hacking activity has escalated tremendously this month.

The firm, which provides regulatory and compliance-related insights, reported that October is already the biggest month in crypto hacks this year, and predicted that should the current trend continue, then 2022 is on course to surpass 2021 as the year with the most ever hacking activity. Chainalysis compared figures recorded across the two years, revealing that the 2022 number in terms of value lost to hacks this year has already grown beyond $3 billion across 125 hacks.

Last Tuesday, there was as much as $120 million of exploits, led by the massive $113 million attack on Solana’s Mango protocol. Earlier in the month, $100 million was siphoned off the bridge between Binance’s BNB and Beacon chains. This attack was a sign of hackers targeting cross-chain platforms in a month, during which 82% of all losses so far ($600 million) have been attributed to breaches on bridges.

Mango Market DAO settles with exploiter

Mango Markets, the DeFi protocol governance forum which suffered a $113 million exploit just over a week ago, earlier considered settling with the hacker. An overwhelming majority of voting tokens showed support for this decision, with the proposal receiving 96.6% votes in favor. The votes for ‘yes’ included those from the exploiter who used the stolen tokens. As part of the settlement, the decentralized, cross-margin trading platform agreed not legally to charge the involved party but instead let them retain $47 million as a bug bounty and return$66 million of the stolen tokens.

The Mango exploiter, one Avraham Mayer Eisenberg, made a clean breast of the thing over the weeked, admitting that he was behind the act. Eisenberg explained that his actions and those of the team he worked with were legal. He brought to the fore a bad debt with the Treasury as justification. The exploiter also committed to and returned the agreed-upon sum of $66 million in different coins

“To remedy the situation, I helped negotiate a settlement agreement with the insurance fund with the goal of making all users whole as soon as possible as well as recapitalizing the exchange […] Once the Mango team finishes processing, all users will be able to access their deposits in full with no loss of funds,” Eisenberg wrote.

Coming at a time the industry is seeing heightened exploits, the hacks drew commentary from several industry leaders, including FTX CEO Sam Bankman-Fried. In a tweet shared after the exploit, the exchange executive picked holes in oracles. Bankman-Fried pointed out that these third-party services, which connect smart contracts (on-chain) with the external world and deliver data from this off-chain environment, can’t always get the correct read on positions.

Perhaps the most significant takeaway and lesson for Mango Markets, and other builders, is the need to be thorough when developing DeFi projects. Polygon co-founder Sandeep Nailwal opined  in an oct. 15 tweet  that while blockchains do not presently solve user problems, they improve how they were resolved before.

Phantom wallet users preyed on by a bogus password-stealing update

A compromised update targeting Solana’s Phantom wallet proves that cybercriminals aren’t slowing down. A password-sniffing malware was rooted in this fake update which was propagated via NFT airdrops earlier this month. In this guise of an update to the Phantom wallets, the attackers targeted users who are not punctilious.

The update’ warning’ read in a tone of urgency, falsely advising users that “Phantom requires all users to update their wallets. This must be done as soon as possible. Failing to do so may result in loss of funds due to hackers exploiting the Solana network.”

Clicking on an attached link, users were redirected to a new website under the notion of downloading the security update. Here, they would be directed to unknowingly download the malicious file – ‘Phantom_Update_2022-10-08.bat’. Users are then guided to access another file, windll32.exe, which Cybersecurity firm VirusTotal established as malware stealing passwords and SSH keys by draining browser information. Users affected by the scam have since been advised to scan their computers using a trusted antivirus program and transfer their crypto into a new Phantom wallet.