While the cryptocurrency market has made great leaps in terms of price performance in 2023, blockchain security remains a worry. CertiK, a blockchain auditor, revealed that hacks and thefts in the cryptocurrency field accounted for $320 million in stolen products in the first quarter of 2023. In addition, there were a few more thefts reported in the cryptocurrency market recently. Here's a rundown of three crypto attacks you might have missed over the weekend.
GDAC Hack
In what is perhaps the first attack on a centralized crypto exchange in 2023, GDAC, a South Korean CEX, was hacked for almost $14 million on April 9 after the culprit gained control over the exchange’s hot wallets. In contrast to cold wallets, which are offline, hot wallets are always connected online and allow users to transfer and receive tokens. Because they are easier to access, most crypto exchanges keep their customers’ cash in hot wallets.
In GDAC’s case, the hacker took 61 BTC, approximately 350.5 ETH, 10 million WEMIX, and 220,000 USDT from the exchange’s hot wallet and proceeded to transfer them to an unidentified wallet. The company stated that it will attempt to retrieve the stolen funds.
Because hot wallets are linked to the internet, they are quite vulnerable to theft. Hot wallets of major cryptocurrency exchanges have been compromised for millions of dollars over the years. In 2019, a hacker gained access to Binance’s hot wallet and stole $41 million in merchandise. Similarly, in 2019, hackers broke into South Korean exchange Bithumb’s hot wallet and stole $13.4 million.
Terraform Hack
Hacks are nothing new to DeFi projects. The financial vertical of the crypto sector is teeming with hundreds of thousands of apps worth billions of dollars. However, the sector is tainted by faulty codes, network flaws, and lax security, which hackers frequently exploit.
Recently, Terraport Finance, a decentralized exchange that allows token swapping on the Terra Classic blockchain, became the latest DeFi project to be hacked. On April 10, Terraport said that a hacker gained access to the protocol and drained all of its liquidity pools, stealing about $2 million worth of virtual assets.
With the help of on-chain trackers, many social media handles claimed that the stolen funds were transferred to Binance and MEXC Global. Meanwhile, the said exchanges have been notified to freeze the assets before the attacker can withdraw the funds.
SushiSwap bug exploit
In another unrelated DeFi exploit, SushiSwap, the 26th largest decentralised exchange by market capitalization, suffered a loss of $3.3 million due to a bug on its smart contract. As per blockchain security firm PeckShield, the bug appeared on the smart contract Route Processor2, which is used to route trade orders. Meanwhile, according to other reports, the smart contract was launched by a hacker and did not execute authentication checks, allowing the hacker to steal $1,800 in ETH from a single SushiSwap user. At this time, it is unclear whether the contract bug was intentional.
This is not the first time a lapse in a smart contract has led to major losses. In 2016, a hacker discovered a flaw in The DAO, a smart contract on the Ethereum blockchain. The bug allowed the attacker to continuously request that the smart contract deliver money to them, resulting in the theft of 3.6 million ETH, which was then worth over $70 million.
Conclusion
Hacks and network exploits continue to plague the crypto sector. In 2022, hackers stole nearly $4 billion worth of virtual assets. In it, DeFi projects accounted for about 82 percent, or $3.1 billion. Until security measures are enhanced, those investing in crypto projects must run extensive checks to safeguard their investments. It is also recommended that one sets up a cold storage wallet to park their crypto assets rather than park them in centralised exchanges.
