Bitcoin Forum
June 14, 2024, 10:20:19 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Interesting security incidents last week  (Read 67 times)
libert19 (OP)
Hero Member
*****
Offline Offline

Activity: 2534
Merit: 952



View Profile WWW
April 29, 2023, 05:37:13 AM
 #1

1) Attack that rekts OGs

Chill attacker. Crypto OGs are attacked. How exactly? Not yet known.

https://twitter.com/tayvano_/status/1648187031468781568

2) What audits are really worth?

https://rekt.news/merlin-dex-rekt/

3) Trust wallet browser extension mnemonic vulnerability, mnemonic could be brute forced

https://blog.ledger.com/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen/

███████████████████████████
███████▄████████████▄██████
████████▄████████▄████████
███▀█████▀▄███▄▀█████▀███
█████▀█▀▄██▀▀▀██▄▀█▀█████
███████▄███████████▄███████
███████████████████████████
███████▀███████████▀███████
████▄██▄▀██▄▄▄██▀▄██▄████
████▄████▄▀███▀▄████▄████
██▄███▀▀█▀██████▀█▀███▄███
██▀█▀████████████████▀█▀███
███████████████████████████
.
.Duelbits.
..........UNLEASH..........
THE ULTIMATE
GAMING EXPERIENCE
DUELBITS
FANTASY
SPORTS
████▄▄█████▄▄
░▄████
███████████▄
▐███
███████████████▄
███
████████████████
███
████████████████▌
███
██████████████████
████████████████▀▀▀
███████████████▌
███████████████▌
████████████████
████████████████
████████████████
████▀▀███████▀▀
.
▬▬
VS
▬▬
████▄▄▄█████▄▄▄
░▄████████████████▄
▐██████████████████▄
████████████████████
████████████████████▌
█████████████████████
███████████████████
███████████████▌
███████████████▌
████████████████
████████████████
████████████████
████▀▀███████▀▀
/// PLAY FOR  FREE  ///
WIN FOR REAL
..PLAY NOW..
Andrija Branislav
Member
**
Offline Offline

Activity: 280
Merit: 25

CRYPTO WEB3 NEOBANK


View Profile
April 29, 2023, 06:50:00 AM
 #2

It's true, Last week there were a number of security incidents in the cryptocurrency world as OP said the first Cold attacker targeting crypto OG, but the details are still unknown which caught my attention namely Lastly, the Trust Wallet browser extension was found to have a mnemonic vulnerability, which could potentially lead to funds was stolen but from those few moments I think, This incident highlights the importance of staying alert and taking the necessary precautions when it comes to cryptocurrency security.

▀███████▄            enterapp.io       |       CRYPTO WEB3 NEOBANK            ▄███████▀
                            PRE-SALE IS LIVE                           
▀█▄ ▀█▄ ▀█▄        D E C E N T R A L I Z E D   B A N K I N G        ▄█▀ ▄█▀ ▄█▀
Nwada001
Hero Member
*****
Offline Offline

Activity: 616
Merit: 642



View Profile
April 29, 2023, 07:22:21 AM
 #3

It's true, Last week there were a number of security incidents in the cryptocurrency world as OP said the first Cold attacker targeting crypto OG, but the details are still unknown which caught my attention namely Lastly, the Trust Wallet browser extension was found to have a mnemonic vulnerability, which could potentially lead to funds was stolen but from those few moments I think, This incident highlights the importance of staying alert and taking the necessary precautions when it comes to cryptocurrency security.

No one knows how the attacks were made or who they were from. The hacker made it suspicious that the other victim from one end will think it's another victim who attacks him, when it's just the hacker trying to send a gas fee from one of the victims addresses to another, which could be used for token swap in any of the victims wallets that hold a swappable token on them.

According to the link dropped by the OP, the author herself still doesn't know where those leaks are from, and they did not just start last week; they have been happening since sometime last year. And those leaks are not just on trust wallet extensions or Metamask; some hardware wallets are also affected, which means those hardware wallets were connected to an already infected device.

It's just advisable for us to have a completely separate gadget for all crypto transactions and another device for daily use. If possible, to be on the safe side, we should have multiple wallets, even if they're hardware wallets. We should have more than just one and split assets between them so that if one wallet is affected, your entire fortune won't be completely lost.

R


▀▀▀▀▀▀▀██████▄▄
████████████████
▀▀▀▀█████▀▀▀█████
████████▌███▐████
▄▄▄▄█████▄▄▄█████
████████████████
▄▄▄▄▄▄▄██████▀▀
LLBIT
  CRYPTO   
FUTURES
 1,000x 
LEVERAGE
COMPETITIVE
    FEES    
 INSTANT 
EXECUTION
.
   TRADE NOW   
libert19 (OP)
Hero Member
*****
Offline Offline

Activity: 2534
Merit: 952



View Profile WWW
April 29, 2023, 09:33:08 AM
 #4

Some hardware wallets are also affected, which means those hardware wallets were connected to an already infected device.

This is untrue, infected device can't affect hardware wallet since they are airgapped, drains from HW must be leaked to seed leak ( place where user stored his seed, as mentioned in article it could be related to LastPass data breach).

███████████████████████████
███████▄████████████▄██████
████████▄████████▄████████
███▀█████▀▄███▄▀█████▀███
█████▀█▀▄██▀▀▀██▄▀█▀█████
███████▄███████████▄███████
███████████████████████████
███████▀███████████▀███████
████▄██▄▀██▄▄▄██▀▄██▄████
████▄████▄▀███▀▄████▄████
██▄███▀▀█▀██████▀█▀███▄███
██▀█▀████████████████▀█▀███
███████████████████████████
.
.Duelbits.
..........UNLEASH..........
THE ULTIMATE
GAMING EXPERIENCE
DUELBITS
FANTASY
SPORTS
████▄▄█████▄▄
░▄████
███████████▄
▐███
███████████████▄
███
████████████████
███
████████████████▌
███
██████████████████
████████████████▀▀▀
███████████████▌
███████████████▌
████████████████
████████████████
████████████████
████▀▀███████▀▀
.
▬▬
VS
▬▬
████▄▄▄█████▄▄▄
░▄████████████████▄
▐██████████████████▄
████████████████████
████████████████████▌
█████████████████████
███████████████████
███████████████▌
███████████████▌
████████████████
████████████████
████████████████
████▀▀███████▀▀
/// PLAY FOR  FREE  ///
WIN FOR REAL
..PLAY NOW..
vv181
Legendary
*
Offline Offline

Activity: 1932
Merit: 1273


View Profile
April 30, 2023, 11:33:28 AM
 #5

Some hardware wallets are also affected, which means those hardware wallets were connected to an already infected device.

This is untrue, infected device can't affect hardware wallet since they are airgapped, drains from HW must be leaked to seed leak ( place where user stored his seed, as mentioned in article it could be related to LastPass data breach).

A lot of uncertainty on the first issue. One thing is for sure, hardware wallets should indeed not directly expose their key to the device it connected to, if it does, the HW mechanism is faulty and simply not how it is supposed to work essentially.

Due to a lot of variables inherently contained within the wallet drains operation, this kind of issue is tricky since many users have different digital security behaviour or in general how they do with anything related to crypto usage, though it is assumed that's a user-related problem. It is also worth noting that software/wallet-related problem is also a possibility.
Jackl87
Sr. Member
****
Offline Offline

Activity: 1722
Merit: 269


View Profile
April 30, 2023, 03:04:12 PM
 #6

1) Attack that rekts OGs
Chill attacker. Crypto OGs are attacked. How exactly? Not yet known.
https://twitter.com/tayvano_/status/1648187031468781568
2) What audits are really worth?
https://rekt.news/merlin-dex-rekt/
3) Trust wallet browser extension mnemonic vulnerability, mnemonic could be brute forced
https://blog.ledger.com/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen/

Thanks for posting this. All those things that happened in the last week are just another proving again, why the cryptomarket is still kind of a niche market in comparison to traditional financial markets, even though the growth of the crypto space in the last few years was very fast and the adoption is also increasing.
Still somehow it feels like you are only really 100% safe if you have your tokens on a hardware wallet, that was never really connected to a browser wallet or something like that. If you have your projects on a exchange, then you have the risk of losing all of it because the exchange gets hacked, goes out of service or was just a scam to begin with.
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!