Contents
https://x.com/SlowMist_Team/status/1711189023652225356?s=20
SlowMist Weekly Security Report (October 1 - October 7, 2023) Introduction: The blockchain and cryptocurrency ecosystem witnessed another week marked by multiple security breaches. This report details the incidents that took place from October 1 to October 6, 2023, with entities ranging from individual token projects to large-scale platforms facing an array of attack methods, leading to significant financial losses.
Key Points: - Total security incidents: 10 - Notable trend: Increased number of DNS Hijacking Attacks and Discord hacks. - Heaviest loss: Stars Arena with a loss of approximately $3,000,000.
Incidents:
- Galxe (2023-10-06): Unauthorized access gained through DNS hijacking led to the misappropriation of visitor funds, affecting 1,120 users. Loss: ~$270,000.
- MCT (2023-10-06): DNS domain hijacking allowed potential upload of private keys to a fraudulent domain. Precautionary actions were advised. Loss: Not specified.
Fake CommEx token (2023-10-06): Large liquidity removal in a rug pull, with the deployer extracting ~$154k. BSC address specified.
- friend[.]tech (2023-10-05): Four users faced SIM card swap attacks leading to significant losses. Loss: ~$385,000.
- Stars Arena (2023-10-05): A major security breach in the platform's smart contract led to the theft of substantial funds. Loss: ~$3,000,000.
DePay (2023-10-05): The platform faced a flash loan attack leading to a comparatively minor theft. Loss: $827.
- Metropolis World (2023-10-05): The platform's Discord server was compromised. Loss: Not specified.
- GEMIE (2023-10-02): Discord server hacked, leading to phishing links being shared. Users advised against interaction. Loss: Not specified.
- VendX (2023-10-02): Another instance of a compromised Discord server. Loss: Not specified.
Fake EigenLayer Token (2023-10-01):** An exit scam on a falsified token, leading to a significant gain for the deployer. Loss: ~$300,000.
Recommendations: - Be wary of unexpected domain redirects and always double-check URLs - Do not share private keys or sensitive information without verifying the platform's authenticity - Approach Discord announcements with caution, especially if they contain external links -Regular testing and updates are pivotal in minimizing security vulnerabilities
Conclusion: The crypto community remains vulnerable to the persistent threats of social engineering and phishing attacks. Additionally, unless projects prioritize security proactively, vulnerabilities in smart contracts will continue to persist. The diverse nature of the attacks observed this week underscores the importance of multifaceted security strategies. While some entities faced devastating financial setbacks, others were quick to respond and mitigate potential damages.
Please note that the list above contains all the reported events; there could have been others that weren't reported. For additional information, check out https://hacked.slowmist.io
As always, stay vigilant!