Florence Finance Suffered Address Poisoning Attack ~ $1.45M

HashingBits | Week- 48

QuillAudits

Dec 03, 2023

In brief ⚡

Florence Finance Loses $1.45 Million in Phishing Attack: Address Poisoning Exploited in Three-Step Crypto Heist
SAI Pro token involved in an exit scam. Swapped over 1.7 Million
QuillMonitor

Hacks and Scams⚠️

KyberSwap

Amount of Loss: ~ $1.45M

Analysis

Florence Finance, a real-world asset (RWA) lending project, reportedly lost $1.45 million worth of USDC in a phishing attack.
The attack utilized a technique called address poisoning, where hackers created a wallet address closely resembling a legitimate one used by the victim.
The phishing attack occurred in three steps: the victim initially sent USDC to a legitimate address, scammers poisoned the victim's address by sending fake tokens, and the victim, relying on autofill or quick glances at their address book, accidentally sent real tokens to the scammer's address.
The funds were then transferred through multiple wallets, with the phishing wallet (0xB087) eventually bridging the funds to THORChain after converting them to Ethereum (ETH).
As of the report, Florence Finance had not yet made an official statement on platforms like Twitter regarding the incident.

SAI Pro

Amount of Loss: ~ $1.7M

Analysis

SAI pro token on BNB chain was exploited for over 1.7 Million usd.
It was an exit scam and the deployer swapped the funds over multiple transactions
This address has also been found to be involved in Lucky Star hack.

Explore the Depths of Knowledge: Research Papers, Blogs and Tweets🔖

Tweets

Over the past two weeks I have been deep diving into Curve's price oracles and have found extremely strange behavior.

Here is a CRITICAL vulnerability, found in a live protocol with millions at stake💸

On October 4th I found a High within Retro/ Thena which would allow an arbitrary user to steal all rewards for the upcoming weeks.

One of the fastest ways to improve as a beginner.,..

if you’re a beginner and want to up your skills, make sure you 100% understand all of the following codebases:

GitHub Repos

execution-specs

Articles

Web3 Community Spotlight🔦

Note - all the respective links has been embedded in the image

We analyzed a novel version of DOS combining multiple scenarios this week

Would you believe it if we said there’s another technology that boasts just as many use cases as blockchain? Indeed,

Ever felt like there’s a missing puzzle piece in the vast realm of the Bitcoin blockchain? That’s where Bitcoin Ordinals.

Thanks for reading HashingBits! Share a summary of our newsletter on your social media platforms, tag us, and use the #AwareToEarn hashtag, and you could win 10 USDT as a reward! Help us build a safer Web3 ecosystem and have a chance to earn rewards and support our work.

HashingBits