损失1.6亿美元,Wintermute项目是如何被黑客获取私钥的?

成都链安Publicado em 2022-09-21Última atualização em 2022-09-21

Resumo

据悉,Wintermute是一家数字资产算法做市商,其在中心化和去中心化的交易平台以及场外创建流动性和高效的市场,致力于支持、授权和推进真正去中心化的世界。

2022年9月20日,据成都链安鹰眼-区块链安全态势感知平台舆情监测显示,加密做市商Wintermute创始人Evgeny Gaevoy在社交媒体上发文表示,Wintermute在DeFi黑客攻击中损失1.6亿美元。

据悉,Wintermute是一家数字资产算法做市商,其在中心化和去中心化的交易平台以及场外创建流动性和高效的市场,致力于支持、授权和推进真正去中心化的世界。

1.6亿美元,这也是近期Web3领域发生的最大的一笔安全事件。

攻击发生之后,机构借贷协议Maple Finance在其社交平台表示,已经和加密做市商Wintermute取得沟通联系,Wintermute表示有足够能力承担黑客攻击造成的损失,Maple Finance的存款人不会受此次黑客攻击的影响。看来本次项目方也是“资产大户”。

关于本次事件,成都链安安全团队第一时间进行了分析,现将结果解析如下:

攻击者地址:

0xe74b28c2eae8679e3ccc3a94d5d0de83ccb84705

攻击合约:

0x0248f752802b2cfb4373cc0c3bc3964429385c26

被攻击合约:

0x00000000ae347930bd1e7b0f35588b92280f9e75

成都链安安全团队发现,攻击者频繁的利用0x0000000fe6a...地址调用0x00000000ae34...合约的0x178979ae函数向0x0248地址(攻击者合约)转账,通过反编译合约,发现调用0x178979ae函数需要权限校验,通过函数查询,确认0x0000000fe6a地址拥有setCommonAdmin权限,并且该地址在攻击之前和该合约有正常的交互,那么可以确认0x0000000fe6a的私钥被泄露。

结合地址特征(0x0000000),疑似项目方使用Profanity工具生成地址。该工具在之前发的文章中,已有安全研究者确认其随机性存在安全缺陷(有暴力破解私钥的风险),导致私钥可能泄漏。

针对本次事件,成都链安安全团队建议:

1.项目方移除0x0000000fe6a地址以及其他靓号地址的setCommonAdmin/owner等管理权限,并使用安全的钱包地址替换。

2 其他使用Profanity工具生成钱包地址的项目方或者用户,请尽快转移资产。

同时,据成都链安链必追-虚拟货币案件智能研判平台统计结果显示,本次事件被盗了92种资产,价值约1.6亿美元。目前被盗资产中约1.1亿的DAI/USDC/USDT存入Curve.fi协议,获得了1.1亿枚流动性代币,位居流动性提供者排名第3位。

Leituras Relacionadas

The Full Story of How Crypto Unicorn Blockstream Is Mired in Serious Fraud Allegations

This article details serious allegations of fraud against Bitcoin infrastructure company Blockstream, founded by Bitcoin pioneer Adam Back. In June 2024, investigative account NatInfoSec published a report accusing Blockstream's mining note (BMN) program of potentially operating a multi-billion dollar scheme with Ponzi-like characteristics. The core allegations focus on Blockstream Mining Notes (BMNs), which offer investors fixed annual yields up to approximately 20% from Bitcoin mining. NatInfoSec's investigation raises several key issues: 1. **Suspicious Hashrate & Payout Capacity**: The analysis suggests Blockstream would need 20-45 EH/s of mining power to cover its BMN obligations, but its public dashboard shows only around 15 EH/s. Furthermore, no verifiable public evidence (e.g., grid connection records, import data) was found to support the massive mining operation required. 2. **Questionable Payout Source**: The BMN contract allows Blockstream to use Bitcoin from *any source* (Substitute Performance BTC) to fulfill investor payouts, raising concerns that payouts may not come from actual mining revenue. 3. **High-Risk, Fixed Returns**: Offering ~20% fixed yields in the volatile, cyclical Bitcoin mining industry is viewed as highly unusual and requires clear explanation. 4. **Undisclosed Criminal Record of Key Figure**: Christopher William Cook, a key figure in Blockstream's mining operations and CEO of spin-off Exacore, was found to have a federal felony conviction for mail fraud in 2008, a fact not disclosed in BMN offering documents. His background was also allegedly embellished. 5. **Potential Contagion to BSTR SPAC**: Questions were raised about whether these liabilities and Cook's record should have been disclosed in the SEC filings for Bitcoin Standard Treasury Company (BSTR), a separate Adam Back-associated firm planning a SPAC merger. The crypto community is divided. BitMEX Research validated Cook's criminal record and expressed concern over the high yields but found other evidence lacking or misleading, noting the legal separation between BMN, Blockstream, and BSTR. Blockstream defenders, like Samson Mow, argue the mining is real. Critics, however, emphasize the lack of independent, verifiable proof of the mining operation's scale and the true source of investor payouts. The article concludes that BMN remains shrouded in key unanswered questions regarding its actual size, the verifiability of its underlying mining assets and payouts, the source of its high yields, and the full role and disclosure concerning Chris Cook. Blockstream had not issued a comprehensive response at the time of writing.

marsbitHá 5h

The Full Story of How Crypto Unicorn Blockstream Is Mired in Serious Fraud Allegations

marsbitHá 5h

Trading

Spot
Futuros
活动图片