[Feature] Critical Alert! A Summary of Security Attacks in September

The total loss due to security-related attacks and exploits in September is about $164.32 million US dollars. According to data from Beosin Blockchain Security, the number and amount of various security incidents decreased in September, compared to August.

The $160 million hack of Wintermute in September was the biggest loss in Web3 space in recent times. Apart from that, there have also been several security incidents that made use of trending events to defraud in the same month, such as Elizabeth tokens, Ethereum’s merge, imitation disk games, etc. To avoid being scammed, users are advised to be more vigilant and not blindly follow trends.

Security attacks and exploits on DeFi Protocols

1. On September 2, crypto exchange Kyber Network suffered a front-end attack and lost about $265,000.

2. On September 2, ShadowFi was attacked, causing its SDF token to plummet, and the attacker made a profit of about $300,000.

3. On September 5, the DAO Officials project on BNBChain was attacked by a flash loan, and the attacker made a profit of about $580,000.

4. On September 7, Nereus Finance, a project on the Avalanche chain suffered a flash loan attack and the attacker made a profit of about $380,000.

5. On September 8, the New Free Dao project suffered a flash loan attack, and the attacker made a profit of $1.25 million.

6. On September 10, the DPC token contract on BNBChain was attacked by hackers, resulting in a loss of about $100,000.

7. On September 18, the Ethereum hard fork blockchain ETHW’s Gnosis Omni Bridge cross-chain bridge project had a contract-level replay vulnerability, which resulted in a profit of about $6,000 for the attacker.

8. On September 20, the crypto market maker Wintermute utilised the Profanity tool to generate a vanity address, resulting in a private key leak and a loss of $160 million.

9. On September 27, an MEV bot was attacked, and the loss was about $1.4 million.

10. On September 28, BXH’s contract once again suffered another flash loan attack, causing a loss of about $40,000.

Security attacks and exploits riding on trending events

1. On September 9, the Elizabeth token was launched, taking advantage of the popularity of Queen Elizabeth’s death, and a malicious code was built into the contract, resulting in investors’ funds being at risk.

2. On September 15, as Ethereum’s merge was approaching, there were lots of fake live broadcasts on YouTube. Fraudsters faked videos of crypto celebrities as the official live stream and attached links to the phishing site.

3. North Korea's Lazarus hackers lure macOS developers and artists with fake job postings on cryptocurrency exchanges.

4. On September 29, the official website and Twitter of the BNB Chain knock-off game “Sheep a Sheep” (YLGY) are now inaccessible, and it is suspected to be a rug pull. The game is modeled after a Chinese mobile game with the same title, yet the game developers clarified they had never developed or licensed any blockchain games.

Other security flaws

The SDK of the decentralized exchange dYdX uses a malicious third-party component that may lead to user credentials leakage.

Summary

Overall, the total loss caused by various blockchain security incidents in September 2022 is about $164.32 million. Among them, the largest loss was incurred by the leakage of private keys. Users and project parties who are using third-party tools or services have to take extra caution.