Blockchain Auditors Say $4m Crypto Theft Enabled By Logging Tech

Blockchain auditors have suggested the reason behind a massive $4 million hack on several crypto-currency wallet providers is a misconfiguration in a widely used event-logging technology. 

Crypto-currency tokens Solana (SOL) and USD Coin (USDC) were among those stolen from Slope wallets by an unknown attacker, after the wallets were found to be leaking seedphrases in plaintext. Seedphrases are strings of randomly generated words used to recover crypto-currency wallets. They are considered secure, and only the owners are supposed to know what these strings are.

Blockchain auditors Zellic and OtterSec have both published the findings from their respective investigations, which are still ongoing, have suggested the reason behind a massive $4 million hack on several crypto-currency wallet providers is due to a misconfiguration in a widely-used event-logging technology.

Professional cyber criminals know that blockchain’s algorithms are secure and have busied themselves looking for other ways to manipulate and penetrate them.

Slope, Solana & Phantom Wallets

In a recent incident, the blockchain platform Solana reported that 7767 wallets were impacted during a security incident in which $4 million was stolen. In addition to Solana customers, Slope and Phantom users were also affected. While the cause of the exploit is unknown, Solana has said that hardware wallets were not affected in the incident and users are strongly encouraged to use this type of wallet. The firm says that engineers from several different operating environments are investigating the incident.

The attack against Solana is the latest in a series of attacks targeting the crypto currency industry and users are advised to take particular care in securing their profiles and wallets, such as revoking third-party permissions and setting up extra security measures.

Blockchain - An Immutable Ledger

Known as an "immutable ledger," blockchain is supposed to be impervious to bad actors and this is one of the reasons blockchain has become so popular is that its design prevents anyone from deleting or changing a record once it has been created. 

This renders blockchain especially useful for crypto currency applications, where it’s important that records of spent money can’t be changed or deleted, as well as e-voting, financial records, manufacturing records, product provenance, and many other applications. However, the ownership blockchains for these coins and tokens are also vulnerable to type of hacking and fraud.
 
Blockchain’s auditors Zellic and OtterSec have concluded the issue stemmed from a misconfiguration in Sentry, an event-logging platform used by many websites and mobile apps in the industry, including the Slope wallet for iOS and Android. Other wallets also affected include Phantom, Solflare, and TrustWallet. 

  • Zellic said “any interaction in the app would trigger an event log. Unfortunately, Slope didn't configure Sentry to scrub sensitive info. Consequently, the seedphrases were leaked to Sentry”.
  • According to  OtterSec, anyone with access to Sentry could access users’ private keys, allowing them to recover wallets that don’t belong to them and transfer tokens to their own personal wallet. 

Zellic’s research suggested that Slope had only been using Sentry for a week before the breach was confirmed. It also found it’s possible to scrub data that doesn’t need to be logged in Sentry via the platform’s software developer kit or via server-side scrubbing.

Almost 1,400 of the addresses in the exploit were present in Sentry logs, although this does not account for all the hacked addresses. The research suggests that there are thousands of additional wallets that contain crypto currency tokens and could currently be vulnerable to additional attacks from the still-unknown hacker.

Owners of a Slope wallet are strongly advised to transfer all tokens into a different method of storage as soon as possible, such as a hardware ledger or centralised exchange. 

ITPro:    Techcentral:     Techopedia:    AnalyticsInsight:     Reddit:     Monash University:     

Oodaloop:    @Zellico.ai:     @osec_io

You Might Also Read: 

Chainalysis Crypto Theft Hotline:   
  

« Killnet Turn Their Attention To Lockheed Martin
Protecting Medical Devices From Cyber Attacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Egress Software Technologies

Egress Software Technologies

Egress Software Technologies is a leading provider of data security services designed to protect shared information throughout its lifecycle.

DKCERT

DKCERT

DKCERT (Danish Computer Security Incident Response Team) is a service of DeIC (Danish e-Infrastructure Cooperation).

Hodgson Russ

Hodgson Russ

Hodgson Russ is a US business law firm. Practice areas include Privacy, Data Breach & Cybersecurity.

Kudelski Security

Kudelski Security

Kudelski Security is an international cybersecurity company providing innovative, independent and tailored security solutions for large enterprise and public sector clients.

Optiv

Optiv

Optiv is a market-leading provider of end-to-end cyber security solutions. We help clients plan, build and run successful cyber security programs that achieve business objectives.

Prove & Run

Prove & Run

Prove & Run provides a patented software development toolchain that is specifically forged to deal with the complex security properties of sensitive software components.

Cellopoint

Cellopoint

Cellopoint is a leading manufacturer of information security and email lifecycle management (ELM) products.

AAROH

AAROH

AAROH helps customers in Government, Law Enforcement, and Enterprises to identify, prevent, detect, resolve and protect from threats, crimes, breaches & fraud.

Sponge

Sponge

Cybersecurity Sorted by Sponge is a seriously engaging training game to make your staff the first line of defence against cyber threats.

Arctic Wolf Networks

Arctic Wolf Networks

Arctic Wolf Networks delivers the industry-leading security operations center (SOC)-as-a-service that redefines the economics of cybersecurity.

Sixgill

Sixgill

Sixgill, an IoT sensor platform company, builds the universal data service and smart process automation software allowing any organization to effectively govern its IoE assets.

Crypsis

Crypsis

Crypsis was built based on a shared vision of creating a more secure digital world by providing the highest quality incident response, risk management, and digital forensic services.

DisruptOps

DisruptOps

Built for today’s cloud-scale enterprises, DisruptOps’ Cloud Detection and Response platform automates assessment and remediation procedures of critical cloud security issues.

IDX

IDX

IDX is the leading consumer privacy platform built for agility in the digital age.

BOXX Insurance

BOXX Insurance

BOXX Insurance Inc. is a new type of insurance company for a new type of risk. Cyberboxx is the first fully-integrated cybersecurity and insurance solution for small-to-medium-sized businesses.

AccountabilIT

AccountabilIT

AccountabilIT is a full spectrum information technology services firm for enterprises with complex information technology needs seeking relief from those challenges.