☠️ Increasing Risk Of Private Key Compromise

HashingBits | Week- 50

In brief ⚡

• Stoic DAO was drained for 100 ETH.

• OKX Dex fell victim to a private key exploit

• DR Token was rug-pulled for over $237k

---

Hacks and Scams⚠️

---

Stoic DAO

Amount of Loss:  ~ $1.1M

Analysis

• Multiple suspicious transactions detected from wallets linked to stoic_dao, resulting in an approximate total loss of $1.1M.

• The attacker's address is https://etherscan.io/address/0xc982543623bbd0d79113f8e24d11cdac765afdd5.

• Some funds have been deposited into the MEXC_Official exchange.

• A portion of the funds has been converted to $USDC, with $66K $USDC parked at the address https://etherscan.io/address/0x0d837ab89370610d522c7bb812597719c216cb0f.

OKX Dex

Amount of Loss:  ~ $2M

Analysis

• On December 13, the OKX decentralized exchange (DEX) experienced a hack amounting to $2.7 million.

• The security breach occurred after the private key of the proxy admin owner was reported to be leaked.

• The proxy admin owner attempted another upgrade at approximately 11:53 pm UTC, but the user continued exploiting tokens, possibly due to the leaked key.

• Scopescan, an on-chain analysis firm, confirmed the attack and stated that an old abandoned contract was targeted but has been located and stopped.

• OKX DEX, in response, removed the compromised DEX proxy from its trusted list and assured that any user losses resulting from the hack would be fully covered.

• CoinSpot, founded in 2014, is among Australia's largest crypto exchanges, with over 2.5 million customers and a profitable track record, but this is its first reported hack.

DR Token

Amount of Loss:  ~ $237k

Analysis

• DR token experienced a significant slippage of approximately 73%.

• The slippage is attributed to the actions of the token deployer who sold tokens equivalent to around $237,000.

• The Binance Smart Chain (BSC) address associated with the slippage is 0x920a7cbD0b5aeD31827385783E7Af245331cA9eE.

• The sell-off by the deployer has had a substantial impact on the token's value and liquidity.

---

Explore the Depths of Knowledge: Research Papers, Blogs and Tweets🔖

---

Tweets

1. Full vid on the $61M @CurveFinance  hack!

2.  I was the auditor that identified and reported a vulnerability in @thirdweb 's contracts. Now that the issue is public, I can talk about how it was discovered and how it all went down.

3. A good paper when auditing Cross-chain/Bridge:  Open problems in cross-chain protocols

4. If you're doing an audit of ERC-4337(Account Abstraction) you must read: 

5. Uniswap V2 has been out for ages. It doesn't have any obvious flaws. Recently I dreamed up a fairly basic potential attack which I knew wasn't going work. But I didn't know *why* it didn't work.   So I did some algebra.  I've just published that algebra here:…

GitHub Repos

1. CreateX – A Trustless, Universal Contract Deployer

Articles 

1. Understanding Compound’s Liquidation

2. Borrowing on Ethereum: Comparing Architecture Evolution of MakerDAO, Yield, Aave, Compound, & Euler

3. Liquidations in Decentralized Finance: A Comprehensive Review

4. The interest rate model of AAVE V3 and Compound V2

5. Halting the Cronos Gravity Bridge

---

Web3 Community Spotlight🔦

---

Note - all the respective links has been embedded in the image

Introduction to Shamir’s Secret Sharing Shamir’s Secret Sharing, named after its inventor Adi Shamir, is a cryptographic method introduced in…

---

---

Thanks for reading HashingBits! Share a summary of our newsletter on your social media platforms, tag us, and use the #AwareToEarn hashtag, and you could win 10 USDT as a reward! Help us build a safer Web3 ecosystem and have a chance to earn rewards and support our work.

---