It’s time for another monthly security recap! BEOSIN Eagle Eye has reported over 19 typical security incidents in February 2022. On the whole, the overall number of security incidents has increased compared to January. The security risks exposed in DeFi still cannot be ignored. Cross-chain bridge projects have been repeatedly hacked, causing huge economic losses that seriously affect the security and stability of blockchain ecosystem. In addition, the incidents related to [rug pulls/crypto sc...

It’s time for another monthly security recap! BEOSIN Eagle Eye has reported over 19 typical security incidents in February 2022. On the whole, the overall number of security incidents has increased compared to January. The security risks exposed in DeFi still cannot be ignored. Cross-chain bridge projects have been repeatedly hacked, causing huge economic losses that seriously affect the security and stability of blockchain ecosystem. In addition, the incidents related to [rug pulls/crypto sc...

The private key of multiple addresses were compromised, and hackers drained the assets on multiple chains. Take ETH as an example. The Deployer address of DEGO Finance is: 0x20FE4B1eD95911487499e53355BB8f14a881D735 The hacker’s address: 0x118203B0f2A3ef9e749D871C8fEF5e5e55ef5C91 The hacker minted 592,582.35 DEGO tokens to the Deployer account of DEGO and 0x118 account respectively via private key:Then removed the liquidity of the ETH-DEGO trading pool:The hacker obtained 269,502 DEGO tokens a...

The private key of multiple addresses were compromised, and hackers drained the assets on multiple chains. Take ETH as an example. The Deployer address of DEGO Finance is: 0x20FE4B1eD95911487499e53355BB8f14a881D735 The hacker’s address: 0x118203B0f2A3ef9e749D871C8fEF5e5e55ef5C91 The hacker minted 592,582.35 DEGO tokens to the Deployer account of DEGO and 0x118 account respectively via private key:Then removed the liquidity of the ETH-DEGO trading pool:The hacker obtained 269,502 DEGO tokens a...

Beosin Alert — The Blockchain Security Situation Awareness Platform reported on April 2 that Inverse finance has suffered an oracle price manipulation attack. The attacker manipulated INV token prices and managed to profit about $15M. Check the following for our full analysis:Exploiter 1：0x117c0391b3483e32aa665b5ecb2cc539669ea7e9 Exploiter 2：0x8b4c1083cd6aef062298e1fa900df9832c8351b3 Attack tx: 0x20a6dcff06a791a7f8be9f423053ce8caee3f9eecc31df32445fc98d4ccd8365 0x600373f67521324c8068cfd025f121...

Beosin Alert — The Blockchain Security Situation Awareness Platform reported on April 2 that Inverse finance has suffered an oracle price manipulation attack. The attacker manipulated INV token prices and managed to profit about $15M. Check the following for our full analysis:Exploiter 1：0x117c0391b3483e32aa665b5ecb2cc539669ea7e9 Exploiter 2：0x8b4c1083cd6aef062298e1fa900df9832c8351b3 Attack tx: 0x20a6dcff06a791a7f8be9f423053ce8caee3f9eecc31df32445fc98d4ccd8365 0x600373f67521324c8068cfd025f121...

On April 17th, 2022, according to Beosin EagleEye, Beanstalk’s Beanstalk Protocol contract was exploited for about 24,830 ETH. Beosin security team analyzed the incident and the findings are shown below. Beanstalk Introduction Beanstalk is a decentralized stablecoin-based protocol. The official website: https://bean.money. Relevant Information Transaction hash: 0xcd314668aaa9bbfebaf1a0bd2b6553d01dd58899c508d4729fa7311dc5d33ad7 Exploiter’s address: 0x1c5dcdd006ea78a7e4783f9e6021c32935a10fb4 Co...

On April 17th, 2022, according to Beosin EagleEye, Beanstalk’s Beanstalk Protocol contract was exploited for about 24,830 ETH. Beosin security team analyzed the incident and the findings are shown below. Beanstalk Introduction Beanstalk is a decentralized stablecoin-based protocol. The official website: https://bean.money. Relevant Information Transaction hash: 0xcd314668aaa9bbfebaf1a0bd2b6553d01dd58899c508d4729fa7311dc5d33ad7 Exploiter’s address: 0x1c5dcdd006ea78a7e4783f9e6021c32935a10fb4 Co...

On April 10, 2022, according to the Beosin-Alert, Gymdefi’s LiquidityMigrationV2 contract was exploited for about 1,327 WBNB. Beosin security team analyzed the incident and the findings are shown below.Related Information● Transaction hash: 0xa5b0246f2f8d238bb56c0ddb500b04bbe0c30db650e06a41e00b6a0fff11a7e5 ● Exploiter’s address: 0x74298086c94dab3252c5dac979c9755c2eb08e49 ● Contract that launched the attack: 0x4e284686fbcc0f2900f638b04c4d4b433c40a345 ● Attacked contract: 0x1befe6f3f0e8edd2d4d1...

On April 10, 2022, according to the Beosin-Alert, Gymdefi’s LiquidityMigrationV2 contract was exploited for about 1,327 WBNB. Beosin security team analyzed the incident and the findings are shown below.Related Information● Transaction hash: 0xa5b0246f2f8d238bb56c0ddb500b04bbe0c30db650e06a41e00b6a0fff11a7e5 ● Exploiter’s address: 0x74298086c94dab3252c5dac979c9755c2eb08e49 ● Contract that launched the attack: 0x4e284686fbcc0f2900f638b04c4d4b433c40a345 ● Attacked contract: 0x1befe6f3f0e8edd2d4d1...

It’s time for another monthly security recap! BEOSIN Eagle Eye has reported over 17 typical security incidents in January 2022. On the whole, the overall number of security incidents has slightly decreased compared to last December. Exchange There was 1 typical security incident №1 LCX exchange tweeted that it was hacked by a security attack and the total loss value may exceed $6 million. DeFi There were 9 typical security incidents №1 Tinyman Pools was hacked due to an unknown vulnerability ...

It’s time for another monthly security recap! BEOSIN Eagle Eye has reported over 17 typical security incidents in January 2022. On the whole, the overall number of security incidents has slightly decreased compared to last December. Exchange There was 1 typical security incident №1 LCX exchange tweeted that it was hacked by a security attack and the total loss value may exceed $6 million. DeFi There were 9 typical security incidents №1 Tinyman Pools was hacked due to an unknown vulnerability ...

On December 30, BEOSIN’s Eagle Eye alerted that the Sashimi Swap was hacked at 09:06 UTC on December 30, with a total loss of nearly USD 200,000. Regarding this security incident, our security technical team have conducted a brief analysis of the hacking process. #1 Overview SashimiSwap is a decentralized trading protocol for multi-chain deployments based on AMM and swap pools. It has an embedded investment platform designed to increase the revenue of liquidity providers and it is deployed on...

On December 30, BEOSIN’s Eagle Eye alerted that the Sashimi Swap was hacked at 09:06 UTC on December 30, with a total loss of nearly USD 200,000. Regarding this security incident, our security technical team have conducted a brief analysis of the hacking process. #1 Overview SashimiSwap is a decentralized trading protocol for multi-chain deployments based on AMM and swap pools. It has an embedded investment platform designed to increase the revenue of liquidity providers and it is deployed on...

On April 8, 2022, according to Beosin-Alert, StarStream Finance’s DistributorTreasury contract was exploited for 532M $STARS, then 900ETH was swapped out by the hacker. Beosin security team analyzed the incident and the results are as follows:StarStream IntroductionStarstream is a suite of products that provides revenue aggregation, revenue generation and one-click smart contracts on Metis L2 rollup. The protocol is maintained by various devs and managed by STARS holders.Related Information● ...

On April 8, 2022, according to Beosin-Alert, StarStream Finance’s DistributorTreasury contract was exploited for 532M $STARS, then 900ETH was swapped out by the hacker. Beosin security team analyzed the incident and the results are as follows:StarStream IntroductionStarstream is a suite of products that provides revenue aggregation, revenue generation and one-click smart contracts on Metis L2 rollup. The protocol is maintained by various devs and managed by STARS holders.Related Information● ...

It’s time for another monthly security recap! BEOSIN Eagle Eye reported 21 typical security incidents in December 2021. On the whole, the number of blockchain security incidents in December is not much different from that in November, and the overall number of security incidents is still at a high risk level. DeFi There were 8 typical security incidents №1 Automated market maker protocol MonoX is hacked by a flash loan, losing about $31 million. №2 DAO tool project 0xHabitat was hacked, and t...

It’s time for another monthly security recap! BEOSIN Eagle Eye reported 21 typical security incidents in December 2021. On the whole, the number of blockchain security incidents in December is not much different from that in November, and the overall number of security incidents is still at a high risk level. DeFi There were 8 typical security incidents №1 Automated market maker protocol MonoX is hacked by a flash loan, losing about $31 million. №2 DAO tool project 0xHabitat was hacked, and t...

Beosin Eagle-Eye has detected that Build Finance DAO suffered a governance attack. Our team has conducted a detailed analysis of this incident. Here are our findings: #1 Incident overview The Build Finance DAO suffered a “hostile governance takeover” on Feb.14th 2022. The hacker managed to take over the Build token contract by obtaining enough votes, minted over 1 billion BUILD tokens in three transactions, and drained most of the funds in balancer and Uniswap liquidity pools. After the incid...

Beosin Eagle-Eye has detected that Build Finance DAO suffered a governance attack. Our team has conducted a detailed analysis of this incident. Here are our findings: #1 Incident overview The Build Finance DAO suffered a “hostile governance takeover” on Feb.14th 2022. The hacker managed to take over the Build token contract by obtaining enough votes, minted over 1 billion BUILD tokens in three transactions, and drained most of the funds in balancer and Uniswap liquidity pools. After the incid...

Beosin Eagle Eye reported that on March 3, 2022, Arbitrum-based marketplace TreasureDAO was exploited and over 100 NFTs were stolen. However, almost all hacked NFTs have been returned after a few hours of this exploit. The following is Beosin’s detailed analysis of this incident: #1 Overview The transaction initiation address exploited a logic flaw in the TreasureMarketplaceBuyer contract to obtain ERC-721 tokens at no cost by setting the totalPrice to zero through a vulnerability in the buyI...

Beosin Eagle Eye reported that on March 3, 2022, Arbitrum-based marketplace TreasureDAO was exploited and over 100 NFTs were stolen. However, almost all hacked NFTs have been returned after a few hours of this exploit. The following is Beosin’s detailed analysis of this incident: #1 Overview The transaction initiation address exploited a logic flaw in the TreasureMarketplaceBuyer contract to obtain ERC-721 tokens at no cost by setting the totalPrice to zero through a vulnerability in the buyI...

As the Collins Dictionary’s word of the year for 2021, NFT continues to evolve rapidly in 2022. Recently, the NFT version of the first-ever tweet by Jack Dorsey has been offered for about $48 million on Opensea. Despite the popularity and rapid growth of NFT, the hidden risks such as scams or attacks still cannot be ignored. Our previous blog “Losses Exceeds $1M. Jay Chou’s Bored Ape NFT Got Stolen by a Discord Phishing Attack — Beosin’s Analysis” has also addressed the phishing attack that o...

As the Collins Dictionary’s word of the year for 2021, NFT continues to evolve rapidly in 2022. Recently, the NFT version of the first-ever tweet by Jack Dorsey has been offered for about $48 million on Opensea. Despite the popularity and rapid growth of NFT, the hidden risks such as scams or attacks still cannot be ignored. Our previous blog “Losses Exceeds $1M. Jay Chou’s Bored Ape NFT Got Stolen by a Discord Phishing Attack — Beosin’s Analysis” has also addressed the phishing attack that o...