Ornella Hernandez

Macauley Peterson

<div id="highlights-block_63484ebbf8545" class="highlights">
 <ul>
 <li>Hackers have grossed $718 million so far during October, Chainalysis says</li>
 <li>At least four known exploits targeted DeFi protocols on Oct. 11 alone</li>
 </ul>
 
</div>



The culprit behind the <a href="https://cms.blockworks.co/mango-markets-mangled-by-oracle-manipulation-for-112m/" target="_blank" rel="noreferrer noopener">$112 million siphoned from Mango Markets</a>, a decentralized finance trading platform on the Solana blockchain, may have trouble cashing out.



The attacker manipulated the spot price of the Mango governance token (MNGO) on centralized exchanges, then used the inflated coins as collateral to borrow stablecoins, leaving the protocol with bad debt once the price of MNGO returned to Earth.



The exploiter then proposed to return a fraction of the funds via the platform&#8217;s governance system. In a curious twist, the exploiter’s address, it emerged, turned out to be <a href="https://explorer.solana.com/address/yUJw9a2PyoqKkH47i4yEGf4WXomSHMiK7Lp29Xs2NqM" target="_blank" rel="noreferrer noopener">the leading “yes” vote</a> for that proposal.



The ill-gotten stablecoins can be traced on the blockchain <a href="https://solscan.io/tx/5BxPxnby7tTrFnoy6LjpNTGxoUmBvFD3cAdUuozRdwESwxR8Vpj1Ph5t4wfYAh5Gjyx3hAN5PBXjbJtZ4Hw5qtg3" target="_blank" rel="noreferrer noopener">from Solana</a> to corresponding USD Coin (USDC) <a href="https://etherscan.io/tx/0xdd9cc9178e326c3678c49fac4aeab9deb4ed058dec0f907d5b8562f24c0f5c04" target="_blank" rel="noreferrer noopener">transfers on Ethereum</a>. The funds were then <a href="https://etherscan.io/tx/0xab6dca63908c69a2dc98394fc3559972e1150dd03fb4f2f957ad1f4d7899de7e" target="_blank" rel="noreferrer noopener">swapped</a> through a decentralized exchange to dai (DAI), which removed the risk of being frozen by USDC issuer Circle.



“Circle is investigating the incident in question and will take appropriate action,” a Circle spokesperson told Blockworks.



The Ethereum wallet that received the stolen funds now holds over $30 million in assets, including the ENS domain ponzishorter.eth. The wallet has <a href="https://debank.com/profile/0xadbab4f38ff9dcd71886f43b148bcad4a3081fb9/history" target="_blank" rel="noreferrer noopener">a long history</a> of NFT and DeFi-related transactions — unusual for a heist of this magnitude, where perpetrators tend to limit links to any potentially identifying information. That may aid law enforcement or exchange investigators seeking to link the address to a real person.



The incident revealed a weakness in Mango Markets’ price oracle, which FTX CEO Sam Bankman-Fried <a href="https://twitter.com/SBF_FTX/status/1580170248120324096" target="_blank" rel="noreferrer noopener">described</a> as a failure of risk management.



<h3 class="wp-block-heading">Four DeFi hacks in one day</h3>



The Mango Markets hack stood out for the large quantity of funds that was stolen. However, it was just one of four attacks on decentralized finance (DeFi) protocols that took place on Oct. 11. In total, approximately $115 million was stolen.



The <a href="https://cms.blockworks.co/templedao-loses-2-million-in-latest-exploit/" target="_blank" rel="noreferrer noopener">second-largest exploit targeted TempleDAO</a>, a yield-farming DeFi protocol, resulting in the loss of 1,831 ether, or $2.34 million at press time. 



Stax, a decentralized application powered by TempleDAO, <a href="https://twitter.com/staxfinance/status/1579855195693256704?s=20&amp;t=nibDhr9Xb0kQQ8PzALYKqA" target="_blank" rel="noreferrer noopener">tracked</a> the address of the actor responsible, and in the meantime, cautioned users against making further deposits into STAX contracts.



In third place, layer-1 blockchain QANplatform <a href="https://medium.com/qanplatform/qanx-bridge-wallet-disclosure-analysis-continuously-updated-724121bbbf9a" target="_blank" rel="noreferrer noopener">suffered</a> a bridge hack during which 1.4 billion QANX tokens, or just over $1 million, were drained from the QANX Bridge on both the Binance Smart Chain (BSC) and Ethereum.



The company stated that only the QANX Bridge smart contract deployer wallet was compromised — and that affected QANX token holders will be compensated.



The last target of Oct. 11 was Ethereum wallet service Rabby, which <a href="https://twitter.com/Rabby_io/status/1579819525494960128?s=20&amp;t=9YnaBr4LrW53AuOCjbkLuw" target="_blank" rel="noreferrer noopener">reported</a> an exploit in its smart contract for its Rabby Swap feature that resulted in an approximately $200,000 loss. It is still reportedly tracking the stolen funds.



These attacks all took place days after the <a href="https://cms.blockworks.co/binance-pauses-trading-of-native-token/" target="_blank" rel="noreferrer noopener">exploit of Binance’s BNB Chain that affected the BSC Token Hub</a> — the native cross-chain bridge between BNB Beacon Chain and BNB Smart Chain. The hacker successfully extracted around $100 million before being shut down.



BNB Chain is assessing next steps to upgrade and remedy the vulnerability.



“BNB Chain is less decentralized than Ethereum now, but more decentralized than many others. It will become more and more decentralized as our tech team continues to make progress,” <a href="https://www.bnbchain.org/en/blog/bnb-chain-a-decentralized-response/" target="_blank" rel="noreferrer noopener">according to</a> a BNB Chain blog post.



<h3 class="wp-block-heading">It’s been a rough year</h3>



The month of October — which is less than halfway through — has recorded the highest value hacked all year — $718 million across 11 different DeFi protocols so far, according to blockchain analytics unit Chainalysis.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">1/ After four hacks yesterday, October is now the biggest month in the biggest year ever for hacking activity, with more than half the month still to go. So far this month, $718 million has been stolen from <a href="https://twitter.com/hashtag/DeFi?src=hash&amp;ref_src=twsrc%5Etfw">#DeFi</a> protocols across 11 different hacks. <a href="https://t.co/emz36f6gpK">pic.twitter.com/emz36f6gpK</a>&mdash; Chainalysis (@chainalysis) <a href="https://twitter.com/chainalysis/status/1580312145451180032?ref_src=twsrc%5Etfw">October 12, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The second-highest month was March, due to the <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Ronin network’s breach for roughly $625 million</a>, or 173,600 ether and 25.5 million USDC — the largest single hack to date. 



Chainalysis suggests that if this trend continues, 2022 will “likely surpass 2021 as the biggest year for hacking on record.”



Last year recorded over 200 hacks and more than $3 billion in losses. This year has already seen 125 hacks as it approaches the $3 billion threshold.



Cross-chain bridges appear to be a major target for hackers, accounting for 82% of losses this month and 64% of losses all year, according to Chainalysis data.



Youwei Yang, chief economist at bitcoin mining company BIT Mining Limited, told Blockworks that the technology behind cross-chain bridges “has to take some time to develop more thoroughly,” and attributes most problems to “the validators that are not that large of a group nor decentralized enough.”



He added that frequent hacks are “another reason why institutional investors — especially old money — are not fully ready to join the crypto force yet.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

October Already Record Month for Hacks and Exploits

Ben Strack

<div id="highlights-block_63408f996c97c" class="highlights">
 <ul>
 <li>BNB Chain contacted community validators to stop incident from spreading</li>
 <li>“Either be fully decentralized, or be centralized enough to have responsibility for responding to security incidents,” OpenZeppelin head of solutions architecture says</li>
 </ul>
 
</div>



Following attackers <a href="https://cms.blockworks.co/binance-pauses-trading-of-native-token/" target="_blank" rel="noreferrer noopener">exploiting Binance’s BNB Chain</a> and withdrawing 2 million BNB, the crypto industry is now grappling with questions of decentralization, responses to security incidents and the prevalence of hacks.



Operators and protocols in the space must choose to become fully decentralized or be better prepared to respond to hacks, said Michael Lewellen, head of solutions architecture at blockchain security firm <a href="https://www.openzeppelin.com/" target="_blank" rel="noreferrer noopener">OpenZeppelin</a>.



BNB Chain said <a href="https://www.bnbchain.org/en/blog/bnb-chain-ecosystem-update/" target="_blank" rel="noreferrer noopener">in a statement Friday</a> that the latest exploit affected BSC Token Hub — the native cross-chain bridge between BNB Beacon Chain and BNB Smart Chain.



Blockchain analytics unit <a href="https://blog.chainalysis.com/reports/cross-chain-bridge-hacks-2022/?utm_campaign=twitter&amp;utm_source=OrganicSocial&amp;utm_content=Thread" target="_blank" rel="noreferrer noopener">Chainalysis estimated in August</a> that $2 billion worth of crypto had been stolen across 13 cross-chain bridge hacks. Attacks on bridges accounted for 69% of total funds stolen this year, the company said at the time.



“Decentralized chains are not designed to be stopped, but by contacting community validators one by one, we were able to stop the incident from spreading,” BNB Chain said in a statement Friday.



BNB Smart Chain has 26 active validators and 44 in total, the network stated, adding that it seeks to expand the validators to boost <a href="https://cms.blockworks.co/what-it-takes-to-halt-a-decentralized-blockchain-like-binance/" target="_blank" rel="noreferrer noopener">further decentralization</a>.



Though BNB Chain reported “the vast majority of the funds remain under control,” a spokesperson did not immediately return a request for further comment.&nbsp;



The latest hack is likely to spur operators to address the lack of automated response to security incidents in the crypto space, Lewellen told Blockworks.&nbsp;



Founded in 2015, OpenZeppelin has a platform allowing users to manage smart contract administration, such as access controls, upgrades and pausing. The company safeguards tens of billions of dollars in funds for organizations such as Coinbase and the Ethereum Foundation.



Keep reading for excerpts from Blockworks’ interview with Lewellen following the hack.



Blockworks: What do you make of this latest hack on the BNB Chain?



Lewellen: This is actually kind of a weird one, as this is a bug that was in a pre-compiled smart contract.



With Binance Chain, they were just adding a lot of features into the native protocol to support smart contracts, and that’s where the bug ended up coming in. So I think there needs to be a question of whether these sorts of changes should be in a native protocol. Maybe it should be contained within a smart contract and kept outside of the scope of the protocol because these things are risky.



We don’t know how the bug appeared inside of the protocol or its original source. But where code is — and the level of safety pieces of code have depending on what layer they’re in — need to be better.



These proof-of-authority chains and bridges kind of complicate that. It’s no longer a clear hierarchy. There’s now a lot of different layers happening in parallel that people need to be a lot more conscious of.&nbsp;&nbsp;&nbsp;



Blockworks: How could the response to this hack have been better?



Lewellen: While I think they responded well overall here, there’s a larger question of…was this really the best that could be done if that role was embraced.



I can’t speak to what the Binance Chain validator community does or how they coordinate or practice for these sorts of things…but they’ve obviously practiced it once now.



I’m speaking as someone from the outside, but seeing other DeFi projects respond to this as their client, I think there could be a lot more diligence and embracing the role of someone that has the ability to respond to security incidents.&nbsp;



And if they don’t have the role, they just need to be very up-front with that. Whether there’s a hesitancy to utilize it in some cases and maybe not in others, right now obviously it exists and I think it could be done better in the future if we learn a lot from this. &nbsp;&nbsp;



Blockworks: Can you point to any examples of an effective automated instant response to a hack?



Lewellen: We’re still in the early stages. I think we’re seeing teams that are getting better at detecting things and responding, but I think honestly these hacks have been occurring on bridges that I don’t think have been embracing that same level of due diligence.



I don’t think we’ve seen a good case for that. We know it’s possible, we’ve done the simulations at OpenZeppelin to know it’s feasible, and we’ve built tools to address it. But ironically I think the teams best prepared for that might be the teams that are least susceptible to being hacked in the first place.



The people that are being hacked the most are also the ones that I think are the least prepared to be hacked.



Blockworks: What sorts of tools or practices should be used to quickly defend against hacks?&nbsp;&nbsp;



Lewellen: What [operators] really need is something that gives you immediate notification, or basically something that is watching everything on-chain…analyzing it and then determining, “were any risks exposed here?”



If large amounts of funds get moved, it’s probably fine and part of the day-to-day operations, but if it falls out of the norm…[it’s important to have] immediate notification of that.



If you can go further and detect things that should never occur, such as money moving out of a vault that should be locked or more tokens than what should be in the token supply existing…you know something’s happening. If not getting people immediately on call to respond, maybe even automating some of the ways that you might immediately cut down some of the exit ramps…or getting your validators to be ready to respond and maybe even doing drills with them.



Blockworks: What is the key for operators as they seek to address security risks going forward?&nbsp;



Lewellen: I think it’s going to be becoming a little bit more honest with the role of different operators and protocols and what the administrative powers are.&nbsp;



With the Ethereum blockchain, the way that Binance Chain responded would not have been possible for Ethereum, but Ethereum also creates this expectation that the chain isn’t going to step in and save you.



If you’re going to have that sort of approach where you have a network where people can respond, either embrace it or move away from it. Either be fully decentralized, or be centralized enough to have responsibility for responding to security incidents. Embrace the role fully by trying to be as prepared as possible and telling node operators for your network that this will be their responsibility.



This interview has been edited for clarity and brevity.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

BNB Chain hack