Jump Crypto & Oasis.app 'counter exploits' Wormhole hacker for $225M

Jump Crypto & Oasis.app 'counter exploits' Wormhole hacker for $225M

Tidsstempel: 24. februar 2023 kl. 8:20

Web3 infrastructure firm Jump Crypto and decentralized finance (DeFi) platform Oasis.app have conducted a “counter exploit” on the Wormhole protocol hacker, with the duo managing to claw back $225 million worth of digital assets and transfer them to a safe wallet.

The Wormhole attack occurred in February 2022 and saw roughly $321 million worth of Wrapped ETH (wETH) siphoned via a vulnerability i protokollens symbolbro.

Hackeren har siden shifted around the stolen funds gennem forskellige Ethereum-based decentralized applications (dApps), and via Oasis, they recently opened up a Wrapped Staked ETH (wstETH) vault on Jan. 23, and a Rocket Pool ETH (rETH) vault on Feb. 11.

I en blog fra 24. februar indlæg, the Oasis.app team confirmed that a counter exploit had taken place, outlining that it had “received an order from the High Court of England and Wales” to retrieve certain assets that related to the “address associated with the Wormhole Exploit.”

The team stated that the retrieval was initiated via “the Oasis Multisig and a court-authorized third party,” which was identified as being Jump Crypto in a preceding report from Blockworks Research.

Transaction history of both vaults angiver that 120,695 wsETH and 3,213 rETH were flyttet by Oasis on Feb. 21 and placed in wallets under Jump Crypto’s control. The hacker also had around $78 million worth of debt in MakerDao’s DAI stablecoin that was retrieved.

"Vi kan også bekræfte, at aktiverne straks blev overført til en pung, der kontrolleres af den autoriserede tredjepart, som krævet af retskendelsen. Vi beholder ingen kontrol eller adgang til disse aktiver,” lyder det i blogindlægget.

Jump Crypto & Oasis.app 'counter exploits' Wormhole hacker for $225M PlatoBlockchain Data Intelligence. Vertical Search. Ai.
@spreekaway tweet on the counter exploit: Twitter

Med henvisning til de negative implikationer af, at Oasis er i stand til at hente kryptoaktiver fra sine brugerbokse, understregede teamet, at det "kun var muligt på grund af en tidligere ukendt sårbarhed i designet af admin multisig-adgang."

Relateret: DeFi-sikkerhed: Hvordan tillidsløse broer kan hjælpe med at beskytte brugere

Indlægget erklærede, at en sådan sårbarhed blev fremhævet af white hat hackere tidligere på måneden.

"Vi understreger, at denne adgang var der udelukkende med den hensigt at beskytte brugeraktiver i tilfælde af et potentielt angreb, og ville have gjort det muligt for os at gå hurtigt for at rette enhver sårbarhed, der blev afsløret for os. Det skal bemærkes, at der på intet tidspunkt, hverken tidligere eller nutid, har været risiko for, at nogen uautoriseret part får adgang til brugeraktiver."

Tidsstempel:

Mere fra Cointelegraph