Crypto scams, hacks and exploits and how to avoid them: Crypto-Sec
Phish of the Week: DeFi Saver user loses $55 million in DAI
A user of decentralized finance management protocol DeFi Saver suffered an unusual style of phishing attack on Aug. 21. According to an X post from blockchain security firm Global Ledger, the attacker tricked the user into reassigning ownership of their DeFi Saver Proxy contract.
The victim reportedly attempted to perform a transaction soon afterward, but it failed. The attacker then changed ownership again and drained the smart contract wallet of all of its Dai (DAI) stablecoin, removing over $55 million worth in total.
(Global Ledger)
Blockchain data shows that the DAI came from the null address rather than from the victim’s address, implying that the attacker must have minted the DAI using the victim’s collateral instead of directly draining it from the victim’s account.
The victim’s smart contract wallet is labeled “DSProxy #166,776” on Etherscan. On Aug. 20, the account owner called the “Set Owner” function and listed a malicious phishing account as the new owner. The owner was likely tricked by a malicious web app into approving this transaction. It was a costly mistake, as the victim is now $55 million poorer.
Web3 users should consider carefully inspecting contract addresses before approving transactions. Many protocols list their official contract addresses in their documents, and users can check these addresses to make sure the one they are about to interact with is listed there. This can often save users from losing funds due to phishing attacks, although no security method is 100% foolproof.
DeFi exploits: iVest announces shutdown after $156K lost
Decentralized finance (DeFi) protocol iVestDAO announced that it will not be able to reopen after suffering from a $156,000 exploit. The protocol had previously stated that it would compensate…
..
