On Tuesday, a crypto whale lost about $55.4 million worth of Dai stablecoin to a phishing attack, on-chain sleuth ZachXBT first noted.
Security firm CertiK noted that the attacker likely accessed EOA using Inferno Drainer. This phishing tool lures victims using fake websites or emails representing legitimate exchanges or DeFi protocols and then steals the user’s private information.
It explained that a malicious actor utilized a vulnerability to access the user’s externally owned account (EOA) that controlled a Maker vault. Maker Vaults are collateralized debt positions that allow users to borrow the U.S. dollar-pegged Dai stablecoin by depositing collateral.
Certik added that the attacker used the EOA to transfer the ownership of the user’s DSProxy (decentralized service proxy) #166,776 to a new address controlled by the attacker. A DSProxy is a smart contract that enables users to execute multiple contract calls in one transaction.
Having gained control of the Maker vault, the attacker set the protocol's owner address to their wallet address and minted 55,473,618 Dai stablecoins into it.
DeFi protocols continue to be the center of cryptocurrency hacks, with DEX aggregation and bridging protocol LI.FI’s security breach last month resulted in losses of $10 million. Immunefi’s July report said the crypto industry saw over $1.19 billion in losses year-to-date due to hacks and scams.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2024 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
