DeFi protocol bZx attacked once again, lost $8 million

[bitcoinst]

Decentralized finance (DeFi) lending protocol bZx was attacked once again last night and lost a little over $8 million due to a faulty code in its smart contracts.

The flawed code allowed an attacker to duplicate assets, or increase their balance of iTokens (interest-bearing tokens of bZx). Hours after noticing the bug, bZx paused minting and burning of iTokens and then unpaused it after a fix that corrected balances for duplications.

The bug allowed the hacker to mint 219,200 LINK tokens (worth about $2.6 million); 4,503 ETH (~$1.6 million); 1,756,351 USDT (~$1.7 million); 1,412,048 USDC (~$1.4 million) and 667,989 DAI (~$680,000). That is $8.1 million in total. bZx said no user funds are at risk as the loss is being covered by its insurance fund.

Marc Thalen, a lead engineer at Bitcoin.com, claims to have initially identified the bug. He said more than $20 million of bZx funds were at risk. Thalen himself tried the exploit out and created a loan using USDC (100 USD). "From this I retrieved iUSDC. I then sent this to myself practically duplicating the funds. I then created a claim for 200 USD," said Thalen.

https://www.theblockcrypto.com/post/77656/defi-protocol-bzx-attacked-lost-8-million-faulty-code

[1714005316]

1714005316

[1714005316]

1714005316

[1714005316]

1714005316

[Zeehaxan]

If that is true it will mean that defi needs better infrastructure than what is available now to move forward, because community supports defi because of no third party intervention and decentralization but all this needs fool proof rather bullet proof security which i hope will be developed in coming months.

[Ucy]

Seems this is the third attack on the company/platform.

I guess this means the huge amount won't be recovered? Well, I think there should be ways to recover or freeze funds once they have gotten to the wrong hands.
The articles I read concerning the hack, claim someone discovered the vulnerability but couldn't get the team fix it quickly. Doesn't sound decentralized to me if things can take this long to detect and fix.
Ethereum DeFi really remains a very risky ecosystem to invest in due mainly to its lack of distinctions between decentralized, centralized, safe and unsafe platforms on the system. It's currently an unorganized system of confusion, disorder, deception, in my opinion.

[kindbtc]

I do not know what is the rush? I mean everyone seems to be in a hurry to launch their defi platforms without even testing and without any kind of security audits whatsoever which is now evident to cause loss of millions, the industry needs to show maturity and professionalism to thrive forward otherwise it can hurt itself.

[ryzaadit]

I do not know what is the rush? I mean everyone seems to be in a hurry to launch their defi platforms without even testing and without any kind of security audits whatsoever which is now evident to cause loss of millions, the industry needs to show maturity and professionalism to thrive forward otherwise it can hurt itself.

If you read the content and response post from @Ratimov at the tops.

The source code has been audit by 2 platforms Peckshield and Certik, anyway the funny things about these cases. The audit cannot give a result when they are auditing the source code its "SAFE" or "NOT" even they are auditing. The case reminds me some scam project when the team change the total supply source code, will this case is an INSIDE JOBS? only times can answers that's.

[ecnalubma]

DeFi Lender bZx Reclaims $8M Stolen in Sunday’s Attack

Well looks like the attackers will not enjoy the money they stole after they were exposed. Unlucky they fail to withdraw funds in clean manner, these hackers probably only knew how to get in but don’t know how to get out.

[Bttzed03]

UPDATE from bZX:

We are relieved to announce that the missing funds are now restored. More information will follow.

Yes, smart contracts are in defi - like a sieve, everything is in bugs and vulnerabilities. bZx had 2 audits, so what? Nothing helped, money is still lost.  

Yup. These codes are made by humans, audited by humans, and we all know humans make mistakes.

"Code is Law" is not true at all.

I do not know what is the rush? I mean everyone seems to be in a hurry to launch their defi platforms without even testing and without any kind of security audits whatsoever which is now evident to cause loss of millions, the industry needs to show maturity and professionalism to thrive forward otherwise it can hurt itself.

This is not the same as the new DeFi projects coming out recently. bZx has been around since 2018 and its code had been audited too. Unfortunately, the hacker still managed to exploit something that the code auditors failed to see. What's more disappointing is that this is the third attack this year alone.

[DarkDays]

Lmao, imaging hacking $8 million, and then giving it back because you forgot to anonymize yourself.

He's probably still going to get stung with a court case now, what an absolute idiot.

Still, it's great to see thieves getting caught. It's far too rare when it comes to cryptocurrencies unfortunately—the thief almost always gets away with it because they exchange to Monero or use a mixer etc.

Hopefully they don't let him off with it. They need to set a precedent here IMO.

[ryzaadit]

Yup. These codes are made by humans, audited by humans, and we all know humans make mistakes.

It's not a reason from "AUDIT Platform" for any kind of business and their service.

They have a service to audit the source code and become the third resource from "non-tech" who doesn't know about programmer and code think and make them secure with the code platform was really safe. Because we have two audit platform who audit the code not only one, and try to accepting the mistake audit because they are human when we have 2 audit platform who make the audit of source code.

If one maybe can accept it, but if more than one still a big question for audit service on how they audit the code.

[jacafbiz]

Although I am not happy this happen, but we need this periodic reality check to make sure that all there DEFI products are hack proof, just imagine that the white hacker that first discover the bug in the platform exploit these and cart away $20 million what are we going to be saying now, this could have crash the DEFI market by now. Any DEFI platform need to be audited and hack proof because these are people's fund

[South Park]

Seems this is the third attack on the company/platform.

I guess this means the huge amount won't be recovered? Well, I think there should be ways to recover or freeze funds once they have gotten to the wrong hands.
The articles I read concerning the hack, claim someone discovered the vulnerability but couldn't get the team fix it quickly. Doesn't sound decentralized to me if things can take this long to detect and fix.
Ethereum DeFi really remains a very risky ecosystem to invest in due mainly to its lack of distinctions between decentralized, centralized, safe and unsafe platforms on the system. It's currently an unorganized system of confusion, disorder, deception, in my opinion.

It is clear that any new improvement in this market will have some growing pains, however this is inexcusable, they knew about the bug and they were simply too slow to fix it and yet the hacker was able to find the bug and exploit it faster than the developers could fix it, what this tell us? That the hacker in question was more skilled than the developers and that should be worrying in a market in which the smallest mistake can cost you and your investors millions of dollars.

[Investo20]

I heard about this news and it was really a bad negative news for the project. This caused a instant price dump also. But as per the latest new I know the attackers got exposed by using on-chain analytics. As soon they tracked down they returned the money. And now this news helped BZRX to recover it's price to some extent. 

[cabron]

Audited twice and yet there are incidents like this still. You shouldn't be promoting this auditing team again. Maybe you need to look at the background of the audit company or just the bZx team itself that for being around of more than 2 years, they still get to be hacked over and over. $8 million is a lot. The hacker must enjoy, you earned!

[Febo]

Decentralized finance (DeFi) lending protocol bZx was attacked once again last night and lost a little over $8 million due to a faulty code in its smart contracts.

What if the whole Decentralized finance (DeFi) lending protocol bZx is a faulty code in a smart contract? You need to zoom out to see the forest. If you zoom in and see each tree you cant see the forest.

[r32godzilla]

Didn´t they promise that they will audit their smart-contract? Maybe they again tried to develop everything quickly to earn as much as possible, but this is the result that DeFi projects need to be developed for a few months to prove bugs and vulnerable places. That's why I only trust MakerDAO and Compound .

[optimisticcm]

I will once again suggest to the community and friends here that are crazy about defi projects and literally are chasing each and every project even without any research, to be careful there is high chance you will lose all your money if you keep chasing these peojects blindly, just calm down and only select the best project to invest not any project which uses defi and promise returns.

[XCANA]

Though the funds  be restored by hackers after they where exposed through the on-chain analytics. That's good to know they have recovered their loose and the problem Solved. My question is: what are the rush for? Don't they always verify or audit their smart contracts? Maybe we should slow it down to avoid this reoccurrence. To be sincere the token is doing very well in the market right now, good products will always attract good investors.

[(o)(o)ilikeboobs(o)(o)]

A project was built too quickly and did not meet security standards but was still confirmed by 2 audit organizations.
They were attacked three times, previous times with the amount of about 1 million dollars, this time even bigger than that.
A large amount of ICO fundraising is worse than anonymous projects like sushi or spontaneous projects like YFI.

[southerngentuk]

I saw the price of it felt down around 32% yesterday but today seems to be recovering a bit as they tweeted on tweeter that the fond is safe, but its the second time such a thing happen to it ? do they even know how to protect investor's money?!

[Bitstar_coin]

What else is new, except the amount stolen is consider reasonable compare to other Defi heist 
Mayb now they will find a way to strengthen their code or whatever is the loophole, because it is always the case, after theft is the solution  we know their strategy too well not to be surprise by this type of inside job news
Okey next news please.........