MetaMask reported a minor security incident

[LuckyCrypto777]

MetaMask reported a minor security incident.
The issue affected part of the company's infrastructure. No immediate threats to MetaMask wallets have been identified at this time.
As a precaution, MetaMask has begun removing affected validators from non-custodial staking.

Days without a security incident in the crypto world: 1 0

https://x.com/MetaMask/status/2105442300335620460

[Oshosondy]

What can happen is that hackers can compromise validators' keys, but it will be difficult to compromise the coins that people staked. I guess this is what that happened.

If it is possible that people coins can be compromised, it would have happened. But anyone that can be able to compromise the coins will need to have access to people's individual private key which is difficult for the hackers to achieve.

[FinneysTrueVision]

Metamask has not given any specific details yet which led to some speculation that it could have been really bad. From the recent on-chain activity, investigators are saying that only 0.36 ETH in staking rewards was stolen by an attacker who managed to change the address where rewards are sent to. It will be a huge relief if that is the extent of the damage, although it’s yet another incident that might make people lose confidence in DeFi. Even with something as low risk as staking, users will be scared of losing funds.

[LuckyCrypto777]

Metamask has not given any specific details yet which led to some speculation that it could have been really bad. From the recent on-chain activity, investigators are saying that only 0.36 ETH in staking rewards was stolen by an attacker who managed to change the address where rewards are sent to. It will be a huge relief if that is the extent of the damage, although it’s yet another incident that might make people lose confidence in DeFi. Even with something as low risk as staking, users will be scared of losing funds.

.

I was hoping for this too, but I came across information in X that real users' wallets had been hacked:



Attacker drained: ETH, BNB, usdt, usdc...

[FinneysTrueVision]

I was hoping for this too, but I came across information in X that real users' wallets had been hacked:



Attacker drained: ETH, BNB, usdt, usdc...

That’s likely unrelated to the staking incident. The staking rewards thief used a fresh wallet with only one transaction receiving ETH from Tornado Cash, whereas in this user’s situation, the drainer is using a wallet that has a lot of activity since last year.

With how popular Metamask is, you’re going to have frequent hacks directly targeting users. An infrastructure compromise is far more rare. It wouldn’t come as a surprise if it was a sophisticated actor, like Lazarus Group or somebody using AI to find an exploit.

[LuckyCrypto777]

I was hoping for this too, but I came across information in X that real users' wallets had been hacked:



Attacker drained: ETH, BNB, usdt, usdc...

That’s likely unrelated to the staking incident. The staking rewards thief used a fresh wallet with only one transaction receiving ETH from Tornado Cash, whereas in this user’s situation, the drainer is using a wallet that has a lot of activity since last year.

With how popular Metamask is, you’re going to have frequent hacks directly targeting users. An infrastructure compromise is far more rare. It wouldn’t come as a surprise if it was a sophisticated actor, like Lazarus Group or somebody using AI to find an exploit.

If you think about it, AI is centralized in the US and China. Could they theoretically track Lazarus members based on their requests?

[FinneysTrueVision]

If you think about it, AI is centralized in the US and China. Could they theoretically track Lazarus members based on their requests?

You can track them but it might be pointless if they are in North Korea where nobody is going to touch them.

It has already been several days and Metamask remains silent on the whole situtation, which I find strange. They even created a dedicated page for updates, where there is nothing since their initial statements.

[LuckyCrypto777]

If you think about it, AI is centralized in the US and China. Could they theoretically track Lazarus members based on their requests?

You can track them but it might be pointless if they are in North Korea where nobody is going to touch them.

It has already been several days and Metamask remains silent on the whole situtation, which I find strange. They even created a dedicated page for updates, where there is nothing since their initial statements.

I agree that they can't be punished physically or legally. But perhaps it would be useful in developing a counterattack plan. The hacking problem is so widespread that all those affected could create some kind of "anti-Lazarus" fund to sponsor hacker groups to counter North Korean hackers. I understand that officially, such a thing is impossible, as it would be like creating a targeted conflict from many countries against one.
So, theoretically, it could be done quietly.
I understand that you'll say it's not that simple, since Lazarus uses intermediary servers for hacking without their knowledge, making counterattacks pointless. In short, it's all complicated.

I'm also keeping an eye on Metamask, but they're really keeping quiet for some reason.

Upd: Just as we were discussing North Korean hackers, an interesting piece of news broke about ZachXBT infiltrating a Chinese criminal syndicate that was laundering crypto for Lazarus Group:

https://bitcointalk.org/index.php?topic=5595964.msg67210077#msg67210077

[JeromeTash]

I agree that they can't be punished physically or legally. But perhaps it would be useful in developing a counterattack plan. The hacking problem is so widespread that all those affected could create some kind of "anti-Lazarus" fund to sponsor hacker groups to counter North Korean hackers. I understand that officially, such a thing is impossible, as it would be like creating a targeted conflict from many countries against one.
So, theoretically, it could be done quietly.
I understand that you'll say it's not that simple, since Lazarus uses intermediary servers for hacking without their knowledge, making counterattacks pointless. In short, it's all complicated.

I'm also keeping an eye on Metamask, but they're really keeping quiet for some reason.

Upd: Just as we were discussing North Korean hackers, an interesting piece of news broke about ZachXBT infiltrating a Chinese criminal syndicate that was laundering crypto for Lazarus Group:

https://bitcointalk.org/index.php?topic=5595964.msg67210077#msg67210077

At this point the North Korean and Lazarus group narrative is so tired. I really wonder who keeps determining who hacked what because, somehow, someone who was sharp enough to breach security protocols and steal funds was not smart enough to cover their tracks.
How sure are we that some of the hacks are not being carried out by some blokes in some basements in some states in the US? For some reasons it's always Russia, North Korea, Iran or China that have the most lethal hackers