cryptd.in

另类 LinkedIn 适合加密人才

Hacker Drains $5.9M From Ethereum Liquidity Provider TrustedVolumes

-

由

cryptd.in
于

TrustedVolumes, a liquidity provider on the Ethereum blockchain, lost about $5.9 million in funds to a hacker on Thursday.

The attacker was able to exploit a vulnerability within the custom trading system used by the platform and managed to withdraw the funds, which included ETH, WBTC, as well as USDT and USDC stablecoins.

What Happened

According to blockchain security firm Blockaid, which caught the exploit as it was happening, the stolen funds included 1,291 WETH, around 16.9 WBTC, roughly 206,000 USDT, and just under 1.27 million USDC.

The attack worked by abusing a design flaw in TrustedVolumes’ custom order-settlement system, known as a Request for Quote (RFQ) proxy.

GoPlus Security posted a breakdown showing that the attacker registered themselves as an authorized “order signer” using a function called “registerAllowedOrderSigner()” that was publicly accessible.

The function allows anyone to designate their own address as a valid signer for trades they controlled, and while normally that would be harmless enough, the settlement function had a separate problem: it checked authorization against one address while actually pulling funds from a different one.

As detailed in a technical report posted by security researcher Defi Nerd, the attacker used that gap to execute four drain transactions against the TrustedVolumes resolver contract, which had previously given the proxy permission to move its tokens.

According to them, each time, the proxy pulled assets from the resolver and sent only a single raw USDC unit back. Then the attacker converted the stolen WETH back into ETH and forwarded everything to their own wallet.

TrustedVolumes confirmed the exploit and publicly posted three wallet addresses holding the stolen funds, asking the hacker to get in touch about a “bug bounty and a mutually acceptable resolution.”

1inch Distances Itself as DeFi Hacks Continue

Because TrustedVolumes functions as a liquidity provider and market maker on 1inch, some early reports framed the incident as a 1inch exploit.

However, that is not accurate, and both 1inch and Blockaid put out statements clarifying that the protocol itself was not compromised and no user funds on 1inch were affected. TrustedVolumes operates independently across multiple platforms, not exclusively on 1inch.

The attack occurred during an especially difficult period for the DeFi ecosystem since it followed a catastrophic month of April, where more than $650 million worth of crypto was stolen from different projects.

KelpDAO and Drift Protocol were the most affected, having $292 million and $285.2 million taken away from them.

So at $5.9 million, this latest exploit is smaller in scale. But the technical sophistication of the approach, deploying a helper contract, abusing self-service signer registration, and exploiting a maker/funding-source mismatch in a single transaction, puts it in a different category from a simple bug or misconfiguration.

职位 Hacker Drains $5.9M From Ethereum Liquidity Provider TrustedVolumes 首次出现在 加密土豆.

评论

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注

最新信息

热门类别

zh_CN 简体中文
zh_CN 简体中文 en_US English ro_RO Română et Eesti ko_KR 한국어 ja 日本語 ru_RU Русский de_DE Deutsch es_ES Español fr_FR Français zh_TW 繁體中文 pt_PT Português it_IT Italiano pl_PL Polski tr_TR Türkçe nl_NL Nederlands id_ID Bahasa Indonesia el Ελληνικά uk Українська bg_BG Български cs_CZ Čeština fi Suomi hu_HU Magyar lv Latviešu valoda lt_LT Lietuvių kalba nb_NO Norsk bokmål sk_SK Slovenčina sl_SI Slovenščina sv_SE Svenska

搜索网站

热门故事

标签

#AlexeyPertsev (1) #BidenCryptoBan (1) #BidenElection (1) #BinanceVsCoinbase (1) #Bitcoin (458) #BitcoinETF (3) #itcoinFundamentals (1) # 比特币处理 (1) # 比特币价格 (5) # 比特币价格水平 (1) #BitcoinPump (1) #BitcoinReserve (1) #BitcoinSurge (1) #itcoinTop (1) #Bitfinex (1) #Bitwise (1) #BracebridgeCapital (1) #BRC20Tokens (1) #BTC 收购 (1) 1TP5 看涨预测 (1) #BullishSentiment (1) #C 中国矿业 (1) #CPIPreview (1) #CryptoAsset (2) #CryptoBattle (1) #CryptoBoom (1) #CryptoExpert (1) #CryptoInsights (1) #CryptoMania (1) #CryptoMarket (4) #CryptoPrediction (1) #CryptoPredictions (1) #CryptoRegulation (2) #CryptoTakeoff (1) #CryptoTiming (1) #CryptoTips (1) #CryptoTreasury (1) #CryptoUncertainty (1) #DerivativeJump (1) #Dogecoin (74) #ogecoinGains (1) #ogecoinVolume (1) #DutchCourt (2) #ECommerce (1) #El萨尔瓦多比特币 (1) #E以太坊 (74) #EthereumPain (1) #E以太坊价格 (1) #ExpertOpinion (1) #FedRateCut (1) #FiatCurrency (1) #F 财务影响 (1) #F 财务隐私 (1) #FirmShutdown (1) #FrozenAccounts (1) #IllicitFunds (1) #InflationData (1) #Investment (1) #InvestmentLoss (1) #JapaneseFirm (1) #L LegalAction (1) #L 法律影响 (1) #Legislation (1) #LightningNetwork (1) #M 市场分析 (3) #M 市场监测 (1) #M 市场预测 (1) #M 市场预测 (1) #M 市场投影 (1) #M 市场支持 (1) #M 市场波动性 (1) #M 婚姻 (1) #MemeCoin (5) #MemeCoins (2) #Miner 盈利能力 (1) #M 洗钱 (2) #MtGox (4) #朝鲜加密货币 (1) #诺沃格拉茨预测 (1) 1TP5价格里程碑 (1) #P 价格预测 (2) 1TP5价格问题 (1) #PriceSurge (1) #PrisonSentence (1) # 量化分析 (1) #R 监管压力 (1) #SECA Anti-Crypto (1) #ShibaInu (6) #SocialBuzz (1) #T 技术分析 (1) #Toncoin (3) #T 龙卷风现金 (3) #T 龙卷风现金发展项目 (1) #T 龙卷风现金开发者 (1) #UKCrypto (1) #UpsidePotential (1) #USCongress (1) #WyomingLand (1) #XRPPrice (1) #XRPupswing (1)

实用链接

我发现了一些有用的链接，希望与大家分享。