Carding
Professional
- Messages
- 2,871
- Reaction score
- 2,371
- Points
- 113
On the night of September 20, the team of the Balancer programmable liquidity DeFi protocol reported that the frontend was hacked and called
for refraining from further use of the platform interface.
According to on-chain data reviewed by ZachXBT analyst, the amount of damage was about $238,000.
Balancer developers are still investigating the incident and it is not officially known whether the hack affected user funds. Project representative in the Discord channel Cosme Fulanito confirmed that the storage is "100% in order".
Balancer is a community-driven protocol on the Ethereum network, launched in 2020. It serves as an automated portfolio manager, liquidity provider, and price tracker.
The platform supports seven EVM-compatible networks. According to DeFi Llama, the total value of funds blocked in the second version of Balancer is $608 million.
The protocol also has a BAL management token. According to CoinGecko, at the time of writing, the asset is trading at $3.27, down 2.5% over the past day.
After the front-end hack, some users reported that when interacting with the website, they were asked to approve a malicious contract that steals funds from their wallets.
"If you open a website, it asks you to change the chain in which you have the largest amount of assets. After confirming the fraudulent transaction, the money will disappear. Don't open the site," one community member warned.
When trying to get to Balancer through the browser, a phishing alert popped up for some time.
On-chain data indicates that the hacker transferred part of the funds to the Avalanche blockchain in the form of "wrapped" ETH and made a test transaction through the Tornado Cash mixer.
Balancer has already experienced its second attack in the past month. On August 22, the project team reported an error related to liquidity pools. Assets deployed on Ethereum, Polygon, Arbitrum, Optimism, Avalanche, Gnosis, Fantom, and zkEVM were at risk. Experts estimated the damage from hacking at $900,000.
After a recent incident, the co-founder of the HashKey platform, Ben El-Baz, asked how you can protect yourself from attacks on Web 2.0 application interfaces when using digital assets.
The lead developer and founder of the Dappling Network, under the nickname 0xBookland, advised ordinary users to use special security extensions like Joinfire. He suggested that the protocols should improve the monitoring system for website updates and improve the threat notification system.
"On-chain DNS is no longer just an option, it is a necessity. This was 100% DNS interception, " suggested representatives of the Decentraweb domain provider.
for refraining from further use of the platform interface.
The balancer frontend is under an attack. The issue is currently under investigation. Please do NOT interact with the balancer UI until further notice!
— Balancer (@Balancer) September 19, 2023
According to on-chain data reviewed by ZachXBT analyst, the amount of damage was about $238,000.
Stolen funds are being directed to this address
0x645710Af050E26bB96e295bdfB75B4a878088d7E
~$238k stolen so far pic.twitter.com/rwMybBaLoA
— ZachXBT (@zachxbt) September 20, 2023
Balancer developers are still investigating the incident and it is not officially known whether the hack affected user funds. Project representative in the Discord channel Cosme Fulanito confirmed that the storage is "100% in order".
Balancer is a community-driven protocol on the Ethereum network, launched in 2020. It serves as an automated portfolio manager, liquidity provider, and price tracker.
The platform supports seven EVM-compatible networks. According to DeFi Llama, the total value of funds blocked in the second version of Balancer is $608 million.
The protocol also has a BAL management token. According to CoinGecko, at the time of writing, the asset is trading at $3.27, down 2.5% over the past day.
After the front-end hack, some users reported that when interacting with the website, they were asked to approve a malicious contract that steals funds from their wallets.
Massive Balancer HACK @Balancer was hacked
If you open the website it asks you to change the chain, where you hold the most amount of money
After that scam transaction is sent, after confirmation money are gone
Don't open the website!!!
Maximum repost pic.twitter.com/d0jYDTeatf
— Hanzo (@DeFi_Hanzo) September 19, 2023
"If you open a website, it asks you to change the chain in which you have the largest amount of assets. After confirming the fraudulent transaction, the money will disappear. Don't open the site," one community member warned.
When trying to get to Balancer through the browser, a phishing alert popped up for some time.
On-chain data indicates that the hacker transferred part of the funds to the Avalanche blockchain in the form of "wrapped" ETH and made a test transaction through the Tornado Cash mixer.
Balancer has already experienced its second attack in the past month. On August 22, the project team reported an error related to liquidity pools. Assets deployed on Ethereum, Polygon, Arbitrum, Optimism, Avalanche, Gnosis, Fantom, and zkEVM were at risk. Experts estimated the damage from hacking at $900,000.
After a recent incident, the co-founder of the HashKey platform, Ben El-Baz, asked how you can protect yourself from attacks on Web 2.0 application interfaces when using digital assets.
The lead developer and founder of the Dappling Network, under the nickname 0xBookland, advised ordinary users to use special security extensions like Joinfire. He suggested that the protocols should improve the monitoring system for website updates and improve the threat notification system.
For users, there are some extensions like @_joinfire
For protocols, the best solution is probably setting up monitoring that:
* Looks at where the frontend is pointing to
* What contracts the frontend is interacting with
and if those don't ever match what is expecting, sent…
— russell ( bookland ) (@0xBookland) September 20, 2023
"On-chain DNS is no longer just an option, it is a necessity. This was 100% DNS interception, " suggested representatives of the Decentraweb domain provider.