Balancer lost $238,000 in a frontend attack

Carding

Professional
Messages
2,871
Reaction score
2,371
Points
113
On the night of September 20, the team of the Balancer programmable liquidity DeFi protocol reported that the frontend was hacked and called
for refraining from further use of the platform interface.

The balancer frontend is under an attack. The issue is currently under investigation. Please do NOT interact with the balancer UI until further notice!
— Balancer (@Balancer) September 19, 2023

According to on-chain data reviewed by ZachXBT analyst, the amount of damage was about $238,000.

Stolen funds are being directed to this address

0x645710Af050E26bB96e295bdfB75B4a878088d7E

~$238k stolen so far pic.twitter.com/rwMybBaLoA
— ZachXBT (@zachxbt) September 20, 2023

Balancer developers are still investigating the incident and it is not officially known whether the hack affected user funds. Project representative in the Discord channel Cosme Fulanito confirmed that the storage is "100% in order".

Balancer is a community-driven protocol on the Ethereum network, launched in 2020. It serves as an automated portfolio manager, liquidity provider, and price tracker.

The platform supports seven EVM-compatible networks. According to DeFi Llama, the total value of funds blocked in the second version of Balancer is $608 million.

The protocol also has a BAL management token. According to CoinGecko, at the time of writing, the asset is trading at $3.27, down 2.5% over the past day.

After the front-end hack, some users reported that when interacting with the website, they were asked to approve a malicious contract that steals funds from their wallets.

Massive Balancer HACK @Balancer was hacked

If you open the website it asks you to change the chain, where you hold the most amount of money

After that scam transaction is sent, after confirmation money are gone

Don't open the website!!!

Maximum repost pic.twitter.com/d0jYDTeatf
— Hanzo (@DeFi_Hanzo) September 19, 2023

"If you open a website, it asks you to change the chain in which you have the largest amount of assets. After confirming the fraudulent transaction, the money will disappear. Don't open the site," one community member warned.

When trying to get to Balancer through the browser, a phishing alert popped up for some time.

On-chain data indicates that the hacker transferred part of the funds to the Avalanche blockchain in the form of "wrapped" ETH and made a test transaction through the Tornado Cash mixer.

Balancer has already experienced its second attack in the past month. On August 22, the project team reported an error related to liquidity pools. Assets deployed on Ethereum, Polygon, Arbitrum, Optimism, Avalanche, Gnosis, Fantom, and zkEVM were at risk. Experts estimated the damage from hacking at $900,000.

After a recent incident, the co-founder of the HashKey platform, Ben El-Baz, asked how you can protect yourself from attacks on Web 2.0 application interfaces when using digital assets.

The lead developer and founder of the Dappling Network, under the nickname 0xBookland, advised ordinary users to use special security extensions like Joinfire. He suggested that the protocols should improve the monitoring system for website updates and improve the threat notification system.

For users, there are some extensions like @_joinfire

For protocols, the best solution is probably setting up monitoring that:

* Looks at where the frontend is pointing to
* What contracts the frontend is interacting with

and if those don't ever match what is expecting, sent…
— russell ( bookland ) (@0xBookland) September 20, 2023

"On-chain DNS is no longer just an option, it is a necessity. This was 100% DNS interception, " suggested representatives of the Decentraweb domain provider.
 
Top