According to the team responsible for the H token, the malware on a compromised developer’s machine allowed seven private key to be exposed. An attacker could then take over bridge infrastructure to trigger the incident and one of largest token incidents this month.
In the report of the postmortem, it was revealed that the attacker had drained 141 million H tokens The circulating currency of Ethereum is now another BNB Chain: 300 Million H Tokens After taking control of the administrative bridge permissions.
According to the report, there is no vulnerability with the bridge contracts or token contracts.
“There was no bug in the bridge, the token, or the Safe,” The team composed a piece.
It was instead traced to an infected developer’s device, where it had been reported that multiple production-specific private keys had been stored.
The attacker gains administrative control of the bridge
Reports indicate that the attacker initially compromised an account owned externally and tied to bridge administration, before seizing control of ProxyAdmin’s contracts.
This allows the exploiter:
- upgrade bridge implementations,
- Ethereum: a way to drain your liquidity
- You can mint a large number of tokens H on the BNB Chain.
According to the team, the BNB Chain tokens are now being considered. “unrecoverable” The attacker is still in control of the bridge permissions.
This incident transformed the compromise of a bridge administrator’s private keys into an all-out takeover.
The report points out operational security failure
Contrary to many DeFi attacks that exploit smart contracts bugs or protocol logic errors, the H event appears to be more closely tied to operational failures.
A single infected computer exposed seven production codes tied to administrative and bridge system.
The attacker was able to use legitimate authorizations instead of bypassing the protocol security mechanism directly.
This exploit is a further indication that even if decentralized infrastructures are implemented, they can fail in a catastrophic way if private key management remains centralized and the endpoint security system is not properly protected.
Online exploitation triggers wider scrutiny
This incident has also generated a wider discussion on Crypto Twitter. ZachXBT was an investigator on the chain who questioned OTC and market making activity of the project. He later clarified that it appeared the exploit had nothing to do with the two.
ZachXBT first raised concern in several posts regarding active token promotions and market-making arrangements surrounding the project.
He later stated that further analysis revealed the “private key compromise” The following are some examples of how to get started: “sketchy MM / OTC” Activity appeared “independent of one another and not related.”
Commentaries reflected the skepticism of the traders, who were trying to decide whether or not the attack was an insider’s act or the result of a real infrastructure breach.
Final summary
- A malware-infected machine used by a developer was found to be the source of the H token. This exposed seven keys that were needed for bridge administration.
- ZachXBT clarified a few days later that the concern about OTC and market making was not related to the compromised private key.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: ambcrypto.com
