Special Topic | Frequently attacked by hackers, where will the DeFi project go?

This incident was an attack on the design of shared composable liquidity between DeFi projects.

According to the preliminary statistical analysis of SlowMist's anti-money laundering (AML) system, the cumulative loss of Lendf.Me being attacked is about 24,696,616 US dollars.

"Kid, do you have a lot of question marks?"

Where is the future of DeFi, which is plagued by security risks?

Balancer, a high-profile decentralized trading platform that is carrying out "liquidity mining", was attacked the night before; Balancer Labs released a description of the attack, initially explaining the reason for the attack and how to deal w

The deflationary tokens on Balancer and its smart contracts are incompatible in some specific scenarios, allowing attackers to create STA/STONK circulation pools with price deviations and profit from them.

Low-cost, high-return, hacker's DeFi "investment method".

Will hackers reach out to Bitfinex in exchange for a reward worth hundreds of millions of dollars?

A GitHub user claims he lost 36.5 BTC due to a bug in his old Electrum wallet.

The CertiK Skynet system (Skynet) detected that 1,400 tokens of the Bitcoin theft incident have begun to be transferred to multiple different addresses.

"This appears to be an oracle manipulation attack."

The safety alarm bell rang.

tomatos.fi is a liquidity mining project, suspected to be from a Chinese team.

So far, the impact of the incident is still in the fermentation.

The CertiK security research team found abnormal transactions in Eminence.finance, a new project of Yearn.finance, and conducted an attack vulnerability analysis on this incident.

Flash loans were once again exploited by hackers and $4 million in funds were stolen.

Another flash loan arbitrage.

Why do hackers love DeFi?

Vulnerabilities in the Axion Network resulted in the accidental minting of nearly 80 billion AXNs. This incident has nothing to do with the audit completed by CertiK.

For project parties, safety audits and regular inspections should not be forgotten; for investors, safety precautions should always be kept in mind and investment risks should be paid attention to.

This is not the first time flash loans have been attacked by arbitrage, and it is estimated that it will not be the last.

Recently, PeckShield monitored that the DeFi protocol Origin Protocol stablecoin OUSD was attacked by reentrancy, causing a loss worth $7.7 million.

In November, hackers attacked the DeFi protocol Pickle Finance (sour cucumber), making nearly $20 million in DAI.

Failing fast in DeFi comes at a huge cost.

Pickle Finance was hacked and the currency price was cut in half. What happened? This article will bring you a detailed analysis of this attack event.

Crazy sushi, hidden risks.

At 3:00 pm on December 1, Beijing time, the CertiK security technology team discovered several large-value transactions in the Compounder.Finance project. It is an internal operation attack incident.

If DeFi developers want to build a huge financial empire in the blockchain world, they must first solve the price oracle problem.

Are your coins safe?

Was the account of the founder of the blockchain insurance platform attacked? How did the incident happen, and how can it be prevented?

Among the many attack methods of current hackers, the "oracle machine" price feed control is the invisible "culprit".

The insurance company has been attacked, what should I do?

CertiK security experts took stock of several typical blockchain projects in 2020, analyzed the reasons why they were attacked and the attack methods used by hackers, as a reference for warning of security accidents in the industry.

SushiSwap was attacked again. This time, the problem was that the transaction fee of the DIGG-WBTC transaction pair was stolen by the attacker through special means.

The specific method of this attack was that the attacker used flash loans to borrow huge amounts of funds, and then carried out circular arbitrage.

Flash loan attacks occur frequently, and CertiK will take you back to the attack on BT.Finance.

To avoid excessive authorization, the security of DeFi has a long way to go.

$160,000 in assets stolen? False alarm.

Excessive authority is hard to guard against.

Exchange counterfeit money for real money.

This is a battle of robots taking place in the dark forest of Ethereum, and the real attackers have little gain in comparison.

On March 14, Beijing time, a new type of attack occurred on True Seigniorage Dollar, with a total loss of about 16,600 US dollars. CertiK will take you to analyze this attack.

On May 13, Beijing time, the CertiK security technology team discovered that the DeFi pledge and liquidity strategy platform xToken was attacked

Binance Smart Chain (BSC) DeFi revenue aggregator PancakeBunny (BUNNY) was attacked by a flash loan from an external developer, and the laboratory immediately carried out analysis.

This attack is a problem in the BurgerSwap architecture. Since the Pair layer completely trusts the data in the PaltForm layer and does not perform another check by itself, the attack occurs.

On May 28, JulSwap, the DEX protocol on the BSC chain and the automated liquidity protocol, was attacked by flash loans.

Recently, there have been frequent attacks on the BSC chain, and contract security needs to be paid more and more attention.

Every time a new platform is attacked, other platform managers should be more vigilant, and immediately check whether there are the same or similar loopholes in their own code, so as to protect their reputation and financial security.

On June 23, the smart pool related to Nerve in the revenue aggregator Eleven Finance may be attacked by flash loans.

The laboratory immediately followed up and analyzed the incident.

As DeFi has risen to prominence over the past two years, high-profile venture funds such as a16z and USV have begun participating in DeFi funding rounds (see Uniswap, MakerDAO, and Compound).

Multiple projects have indicated that they will issue new tokens and have withdrawn all DEX liquidity

Project parties in the DeFi ecosystem need to pay special attention to the threat from "flash loan attacks", and actively cooperate with third-party security companies to build a complete and professional security protection mechanism.

The Memestake project suffered a flash loan attack, and the loss was as high as more than 100,000 US dollars.

​At 6 a.m. on August 4, 2021, Beijing time (block 12955063), multiple smart pools under the Popsicle Finance project were attacked, and the loss amount exceeded 20 million US dollars, which is by far the single largest amount of loss in the DeFi field.

How exactly do these attacks happen? How to protect yourself?

According to CipherTrace, DeFi-related hacks have increased by 270% over the same period.

Breaking down the largest hack in cryptocurrency history.