The truth about ethereum’s sky-high fee transfer: GoodCycle, a fund project, staged a manslaughter!
Previously, a movie "Manslaughter" adapted from India's "Manslaughter and Concealing the Sky" was released and received unanimous praise from the majority of users. It tells the story of the protagonist after the manslaughter, by confusing time and space, falsifying evidence and other montage techniques. the facts of the crime. In the real blockchain world, after the abnormal transfer of sky-high fees, the project parties who are unwilling to disclose the truth to the public are likely to stage a "manslaughter and conceal the sky".
Last week, three incidents of sky-high fee transfer occurred on the Ethereum chain, triggering extensive discussions and speculations in the industry.
Among them, the "mysterious" address starting with 0xcdd6a2b squandered 37 million yuan in just two small transfers within two days, creating the highest transaction fee record in the history of the Ethereum chain.
CoinHolmes, a visual asset tracking platform under the PeckShield security team, based on the existing over 70 million+ address tags, quickly located the address starting with 0xcdd6a2b as a hot wallet of an exchange, and the reason for the two abnormal transfers is likely to be its encounter A GasPrice ransomware attack orchestrated by hackers. For details, please refer to the article "Behind Ethereum's sky-high fee transfer: a GasPrice extortion attack initiated by hackers?》
image description
(V God Twitter's statement on the transfer event of Ethereum's sky-high service fee)
However, with further in-depth analysis found that the problem came:
1) Since the victim is an exchange holding the assets of the majority of users, the exchange did not issue a public statement to remind users of the asset security risks after the incident. We have verified with Spark Pool that the victim Nor has it requested the return of assets from the mining pool. This doesn't make sense.
2) Within one or two days after the two abnormal transfers occurred, there was a large demand for withdrawing coins at the exchange address, and more than 5,000 ETH were withdrawn by users. accounted for.
3) There is still a balance of 16,810 ETH on the address starting with 0xcdd6a2b, and the hackers hiding in the dark seem to have stopped further evil. Could it be that they have reached an agreement?
At this point, things are getting more and more interesting and confusing.
secondary title
Who is the victim exchange?
Since the last article is just our technical analysis and reasoning, whether it is a fact or not, in our original idea, the address starting with 0xcdd6a2b will find a way to get in touch with us, or we should always contact Spark Pool and Ethermine, the packaging mining pool. Let's ask for funds. However, so far, the victim exchange has not revealed any clues.
We had no choice but to start with the address starting with 0x12d8012 and 0xe87fda7 associated with the 0xcdd6a2b address as a breakthrough to further conduct in-depth search and trace. Finally, finally, we found out that the address starting with 0xcdd6a2b belongs to a small South Korean exchange called Good Cycle.
image description
(Good Cycle exchange deposit address and on-chain hot wallet aggregation address)
According to Good Cycle officials, this is a small Korean P2P exchange that just went live on May 25. Since its launch half a month ago, the exchange has had 6,151 users, 6,399 transactions, and a total transaction volume of 63,187.9674 ETH. The reason why it is so popular is that it has a low threshold for participation. It only needs a minimum of $100 to participate, and you can get a high return on investment after participating.
Therefore, the blackmail attack plot carefully planned by hackers has a high probability of being successful.
Therefore, hackers can relatively easily carry out ransom attacks on their server systems;
Therefore, the project party still "forbears" indifferently after suffering a huge asset loss;
Therefore, there are still users who do not know the truth and continue to make their own dreams of investing and getting rich;
Therefore, the blackmail attack plot carefully planned by hackers has a high probability of being successful.
Let's look back at everything from the perspective of the designer of the Ponzi scheme: the loss of only 37 million yuan can only be regarded as a bad start. A good strategy is to accept hackers' extortion negotiations or to cover up the facts.
However, what the project team never expected was that they met CoinHolmes (www.coinholmes.com), a detective in the currency circle who was determined to find out the truth, and PeckShield, the top blockchain security team behind it.
image description
secondary title
Analysis of the possibility of Good Cycle being blackmailed by hackers:
As we guessed above, the hacker’s blackmail attack process is likely to have been completed, and the code loopholes in the website have also been upgraded. We have no choice but to continue to use technical reasoning to reproduce the possibility of this attack. The people of Gua make up the technical logic behind this:
1) One of the possible attack methods: All the information of the user when registering on Good Cycle is uploaded in clear text using HTTP, which is easy to be intercepted by intercepting tools. If the user's account password and PIN code are successfully intercepted by hackers, the hacker will You can log in to the user's account to withdraw cash, because Good Cycle did not perform secondary verification on the account when logging in and withdrawing cash, resulting in loss of assets.
1) One of the possible attack methods: All the information of the user when registering on Good Cycle is uploaded in clear text using HTTP, which is easy to be intercepted by intercepting tools. If the user's account password and PIN code are successfully intercepted by hackers, the hacker will You can log in to the user's account to withdraw cash, because Good Cycle did not perform secondary verification on the account when logging in and withdrawing cash, resulting in loss of assets.
image description
3) The third possible attack method: After obtaining the user's account password, the hacker can obtain the various request headers required for sending the withdrawal request according to the encryption method in the code, directly send a withdrawal request and change the withdrawal address to his own address, so as to attack the user's account.
3) The third possible attack method: After obtaining the user's account password, the hacker can obtain the various request headers required for sending the withdrawal request according to the encryption method in the code, directly send a withdrawal request and change the withdrawal address to his own address, so as to attack the user's account.
epilogue
epilogue
Whether it's our presumed hacker GasPrice attack has succeeded, or there are other reasons. The media, the public, and especially the users involved need an explanation: who will bear the loss of 37 million yuan?
Obviously, the project parties that are still hiding in the dark and unwilling to show up have their own calculations.
But in any case, such a project with the nature of a Ponzi scheme will have a thunderstorm sooner or later. The PeckShield security team has exposed dozens of similar wealth management wallet scams including PlusToken, TokenStore, and EOS ecology, which all confirm this point.
For the project side, it is now the best choice to stand up and admit their mistakes, seek help from the mining pool side, and return the assets of the investing users. If the project side still tries to continue to hide the truth, I believe the problem will only get worse, because Relying on the support of snowballing users Fomo will only delay the death, and sooner or later they will face legal trials.
What needs to be reminded is that in order to help users reduce losses, we have contacted two packaging mining pools. Among them, the 10,668 ETH obtained from Ethermine mining have been equally distributed to miners, and Spark Pool will also be on June 17. The abnormal income is divided equally, and the time window left for the project party to recover the loss is not long.
Friendly reminder: PeckShield currently has more information than disclosed in this article. We are trying to negotiate with the South Korean police to maintain the justice that the blockchain industry should have.
