Unibot, the popular Telegram trading tool, has become the latest victim in an ever-expanding series of cryptocurrency attacks.
Unibot admitted to being attacked on October 31 due to a token-approved vulnerability in a new router. Unibot officially issued an announcement saying: A token approval vulnerability has occurred in the new router, and Unibot has suspended the new router to resolve the issue. Any loss of funds due to the error in the new router will be compensated; the users key and wallet are safe, a detailed response will be released after the investigation is completed. It is reported that the vulnerability caused more than $630,000 in losses. In this article, veDAO Research Institute will bring specific news about the incident and suggestions on how to protect the security of your assets on Telegram.
The whole story of Unibot being attacked
On October 31, blockchain analysis company Scopescan notified Unibot users that the platform was suffering from an ongoing but undetected attack. A vulnerability in one of Unibot’s newly deployed contracts resulted in the loss of multiple users’ cryptocurrencies. The balance is cleared.
Subsequently, Unibot issued the announcement mentioned at the beginning of the article, revealing the first details of the hack and confirming that the attack was due to a token-approved vulnerability in the new router.
Scopescan urges users to de-approval the exploited contract (0x126c9FbaB3A2FCA24eDfd17322E71a5e36E91865) and transfer funds to a new wallet to cooperate with the ongoing investigation by Unibot and blockchain investigators.
Unibot promises to compensate all users who suffer financial losses due to contract loopholes. The attack started at 12:39:23 on the 31st Beijing time and lasted until 14:09:47 on the 31st. During this time, the attacker performed 22 attack transactions, with a total of 42 tokens transferred from 364 victim addresses to the attacker via the router, which the exploiter then sold for a total of 355.5 ETH. Currently all 355.5 ETH have been transferred to Tornado.Cash. According to weekly trading statistics, these include cryptocurrencies such as Joe (JOE), UNIBOT, and BeerusCat (BCAT).
UNIBOT fell nearly 40%
Although Unibot officially promised to compensate for the losses, UNIBOT still plummeted due to the news of the hacker. According to CoinMarketCap data, UNIBOT plummeted from US$58.34 to a minimum of US$35.94 after the incident, with a maximum drop of 38%. It subsequently recovered slightly and hovered at US$42. It is worth noting that despite the strong panic selling, whales and smart money took the opportunity to buy more UNIBOT at the bottom.
Follow-up
On November 1, Unibot announced on Telegram that yesterdays vulnerability had been completely resolved and had been restored to the old router; Unibot was now safe and functioning normally. However, the return of assets of damaged users will take some time: Unibot is currently conducting the final rounds of simulations, intending to take additional measures to ensure the complete return of user tokens. The announcement states that the refund process is taking longer than expected as more than 100 token types are affected by the vulnerability. Since these tokens vary in size and liquidity, refunds will ultimately be made as a mix of different tokens + ETH.
What is Unibot?
Unibot is a trading tool robot built into Telegram. Users can complete the trading activities of on-chain tokens on Uniswap by issuing trading instructions in the form of dialogue with the robot in Telegram, such as token exchange, copy trading, limit orders, Privacy transactions, etc. Unibot is popular on Telegram for its easy-to-use interface. In short, Unibot allows users to switch between different tokens without leaving the chat app. However, users can also leverage MEV to protect trades and copy other traders’ trading schemes. The app’s native token soared to an astonishing $236 in mid-August, demonstrating its popularity.
Learn more about Unibot:https://app.vedao.com/projects/11af33a7c6ee5c9bae19219a682f7a0749779794c4a8ffdee61c16f7d2939b4b
Telegram bot
In addition to Unibot, there are many Telegram bots, such as Mizar, Banana Gun, Maestro and Wagie Bot, which all have many users. Telegram bots are automated programs that run through the Telegram chat program. They can conduct transactions, provide market data to users, assess sentiment on social media, and interact with smart contracts through execution commands initiated through the Telegram interface. Bots of this type have been around for years, but they have gained attention in recent years with the emergence of Telegram bot tokens.
Telegram bot tokens are native tokens integrated into Telegram bots and are mainly used for diverse trading functions, such as executing DEX transactions, managing portfolios across wallets, liquidity mining, and other DeFi-related operations. These tokens essentially allow users to connect to the entirety of DeFi simply by interacting with the Telegram interface.
Starting in late July this year, the popularity of these tokens increased dramatically, with some tokens rising by more than 1,000%. Especially after Unibot came to prominence, a large number of Telegram robot tokens emerged. Currently, 73 Telegram bot tokens are listed on CoinMarketCap.
Unibot - New Issues in Cryptosecurity Hazards
Unibots vulnerability this time means that its smart contract has permission flaws, which may cause users tokens to be moved outside specified limits or gain unauthorized access, thus raising concerns.
Before moving the stolen assets to Tornado.Cash, the attackers first moved them to the decentralized exchange Uniswap. In the crypto world, Tornado.Cash has often been at the center of high-profile hacks and exploits. Several members of the team that developed the protocol were charged in August with helping hackers launder more than $1 billion, including from businesses in North Korea. There were 90% fewer people using the privacy protocol than before the arrests and subsequent penalties.
In the week leading up to the Unibot attack, some LastPass users reported losing $4.4 million in cryptocurrency. Security experts note that this may be due to a LastPass vulnerability last December, although the frequency of breaches over the past ten months has confused many people because they appear to have no rhyme or reason.
Another major weakness in the cryptocurrency space is the cross-chain bridges between blockchains that enable users to transfer assets between incompatible networks. Exactly, a lending platform that relies on Optimism, was hacked in August, resulting in $7 million in losses. Cross-chain bridges like Axie Infinity’s Ronin were exploited by hackers in March 2022, causing a loss of approximately $622 million; there was also the vulnerability of the Wormhole cryptocurrency platform, from which hackers stole a staggering $320 million.
These incidents are a constant reminder that these security issues are unavoidable difficulties as cryptocurrencies continue to develop into the mainstream market.
How to keep assets safe on Telegram
Telegram has become one of the most used messaging programs in the cryptocurrency community. Every major blockchain project and cryptocurrency community has a Telegram account, where they create channels and groups to encourage interaction and community building. Telegrams widespread use has made it a valuable tool for cryptocurrency enthusiasts to learn more and discuss their favorite projects, but it has also attracted the attention of hackers.
Let’s sort out the common cryptocurrency scams on Telegram and how to protect your assets:
Phishing and messaging scams
On Telegram, phishing takes the form of “Smishing.” The aim is to extract sensitive data, often in whale or spear phishing attacks targeting high-profile individuals.
Phishing scams on Telegram usually involve sending messages. There is a method of casting a wide net, sending malicious deceptive information to as many people as possible. More commonly used are spear phishing and whaling attacks aimed at extracting sensitive data, targeting organizations and high-profile individuals.
Off-platform fraud
These scams lure users off the platform and click on links that may trick users into sharing personal information or downloading malware.
imitation scam
Scammers create fake Telegram channels or groups that mimic real channels and make users believe they are part of a real community. You can verify the authenticity of a channel by enabling admin-only publishing in settings and restricting who can add you to the channel.
Pretending to be an encryption expert
Scammers on Telegram pose as crypto experts and promise to boost your earnings. They usually disappear immediately after collecting the users login information.
Pump and Dump Program
These scams promote events that may have an impact on prices, urging users to invest or sell. Be careful when receiving investment advice from strangers in private messages.
Telegram bot
Although Telegram bots can be useful, some hackers have created fake bots. Avoid bots that rush you to take action, check their phone numbers, content they post, and never share sensitive information.
Tech Support Scam
Scammers will pose as support staff in Telegram channels. Never share confidential information with so-called support staff, whether they are bots or real people.
fake giveaway
Be wary of giveaways that ask you to provide your bank details or pay a fee to receive a prize, as these are likely to be scams.
Since almost all cryptocurrency projects are on Telegram and there are so many communities, scammers see it as an attractive platform. Therefore, it is crucial to avoid leaking personal information, sending money, or clicking on suspicious links.
Follow us
veDAO is a one-stop web3 trend tracking intelligent trading platform driven by AI. It combines the market trends presented by big data analysis with the depth of trading, and is committed to creating a web3 AI exchange that is more suitable for Web2 and Web3 users to trade and invest.
veDAO has an industry-leading AI large language model composed of on-chain analysis sentiment indicators, providing users with active data support, combined with intelligent, fast, safe and real-time monitoring AI trading functions. As of now, the number of heavy users of the platform has exceeded 37,000 people, associated with 22,000+ Web3 vertical industry Twitter KOLs, and 180+ professional organizations forming the veDAO expert committee. The platform project library exceeds 8,300+, and 220+ talent scouts are working with veDAO to continuously add Web3 projects.
veDAO continues to upgrade at a bi-weekly version update rate, determined to build a bridge from Web2 to Web3, and become the preferred platform for future Web2 and Web3 users to check projects, find hot spots, see trends, primary investments, and secondary transactions.
Website：http://www.vedao.com/
🔴Investment is risky, the project is for reference only, please bear the risk at your own risk🔴
