Another decentralized finance (DeFi) platform has fallen victim to a cyberattack, this time its Grim Finance. On Sunday, the Yield compounding tool was siphoned off $30 million worth of fantom tokens, the platform officially confirmed.
“The attackers’ address has been identified with over 30 million dollars worth of theft here,” Grim Finance developers tweeted on Sunday morning. “The exploit was found in the vault contract so all of the vaults and deposited funds are currently at risk.”
Hello Grim Community,
It is with heavy hearts that we inform you that our platform was exploited today by an external attacker roughly 6 hours ago. The attackers address has been identified with over 30 million dollars worth of theft here https://t.co/qA3iBTSepb
The developers detailed that the attack was an advanced one as the attacker exploited Grim’s vault strategy by entering a malicious token contract. It used five reentrancy loops to fake five deposits while the platform was still processing the first deposit.
As a measure of safety, the developers have paused all of the vaults to prevent any future funds from being placed at risk and also urged users to ‘IMMEDIATELY’ withdraw all funds.
“The exploit was found in the vault contract so all of the vaults and deposited funds are currently at risk,” the developers detailed.
They have also contacted and notified USD Coin issuer Circle, AnySwap, and Maker to block the hackers’ addresses and freeze the funds.
DeFi evolved from blockchain as the true challenger of the existing banking industry, but remains vulnerable to cyber-attacks. Most recently Vulcan Forged, which is a crypto gaming ecosystem, lost $140 million that already refunded most of the victims. Another platform Cream Finance suffered three attacks within months, losing more than $192 million worth of cryptocurrencies.
Decentralized finance (DeFi) platforms have been the target of criminal attacks this year. Investors in the blockchain-based form of financehave lost billions of dollars to criminals that target the platforms.
The total amount of money deposited at DeFi services has spiked from just $500 million in 2019 to $247 billion this year.
Related Reading | Dog-Themed DeFi Project Mysteriously Loses Fundraised $60 Million
According to a report from London-based firm Elliptic, the overall losses caused by DeFi exploits have totaled $12 billion in the past year. Out of that amount, fraud and theft accounted for $10.5 billion, seven times the amount last year.
DeFi, which has drawn in billions of dollars in investor funds, has also been a frequent target by hackers. They exploit poorly protected protocols, mostly using flash loans.
Related Reading | Poly Network Confirms Hacker Has Returned Most Of The Stolen Crypto
One of the popular attacks this year was the Poly Network hack. Hackers exploited a vulnerability in the multi-chain interoperability protocol. And they took off with roughly $600 million worth of various cryptocurrencies. They however returned most of the stolen funds.
DeFi – The Wild West Of Cryptocurrencies
Elliptic is a firm that tracks movements of funds on the digital ledgers that underpin cryptocurrencies. It recently reported that DeFi exploits amounted to $12 billion this year.
DeFi is often called the “Wild West” of cryptocurrencies because it is still the most unregulated area of crypto. DeFi platforms allow users to lend, borrow and save – usually in cryptocurrencies – without any involvement from middlemen like banks.
“The DeFi ecosystem is an incredibly exciting and fast-moving space, with financial services innovation happening at light speed,” said Tom Robinson, chief scientist at Elliptic. “This is attracting large amounts of capital to projects that are not always robust or well-tested. Criminal actors have seen the opportunity to exploit this.”
According to the report, the underlying technology of DeFi is built on open infrastructure. However, that technology is “relatively immature and untested.” There are bugs in code as well as design flaws that enable criminals to target the platforms.
DeFi market cap at $165.47B | Source: Crypto Total DeFi Market Cap on TradingView.com
“Decentralized apps are designed to be trustless in that they eliminate any third-party control of users’ funds,” said Robinson. “But you must still trust that the creators of the protocol have not made a coding or design mistake that could lead to a loss of funds.”
Criminals can also easily launder proceeds of crime while leaving few traces. “The irreversible nature of crypto transactions make it very challenging to recover these funds,” says the report.
Call For Regulation
With the alarming number of exploits the space is facing, there are calls for DeFi regulation. Regulators are now also turning attention to the sector. However, the actions of regulators in the coming months will play a significant role in determining how well they thrive in the future.
Featured image by Aergo, Chart from TradingView.com
There is no greater fear for cryptocurrency investors than one day forgetting the password to their blockchain wallets, seeing how their own money is right in their hands but still locked away forever from them. If this has happened to you, however, don’t lose hope. There are ways to recover a lost blockchain wallet password, as explained by a leading expert at wallet recovery with years of experience from KeychainX.
Step by Step Guide for Recovering a Lost Blockchain Wallet Password
Blockchain has over 76 million wallets created since its inception in 2011, and many users might have lost their passwords in the passing decade. But if Blockchain.com support will not help you recover your password, what other options do you have? Luckily, Robert Rhodin, the CEO of KeychainX and an expert in the field of wallet recovery, has written a complete step by step guide to help you with the process of recovering it yourself.
Lost your blockchain wallet password?
First, if you forget your password but remember what email you used for creating your wallet, you are able to request they send you all wallets ever created with that address. The link for that service as well as all the upcoming services and software tools you will need to download are all in the guide.
If you are not able to remember the email there are several other options to recover the encrypted wallet. It is possible to use btc recover, an open source Bitcoin wallet password and seed recovery tool, to download the encrypted backup. In order to do this, you will need to install a number of python libraries and be a bit familiar with the command prompt as it has no graphical user interface. If you have a wallet.aes.json backup and do not remember the wallet ID, it is possible to import the wallet into a new Blockchain.com wallet.
Finally, if you have created a second password on your wallet you would be able to use a “brute force” method to crack the password. For this you will need a GPU rig (with one or more NVIDIA or AMD video cards) which is able to try thousands of different passwords per second. In addition to owning GPU cards, you need to use a software tool like hashcat to run the password cracking for you.
If you are still not able to find any password, you could use a bunch of different word lists repositories. Make sure you have plenty of memory space and bandwidth as many of these word lists are 10 to 30GB in size. As you can see, one will need some programming skills and relevant hardware to attempt a wallet recovery. Remember that if all this seems to much for you, there are professional services like KeychainX that will for a fee help you recover your lost Blockchain.com or Blockchain.info wallet.
KeychainX Can Even Recover Blockchain Wallets With 15,17,19 or 21 Mnemonic Words
If you are not yet familiar with KeychainX, it is a bitcoin wallet recovery service operating since 2017. The company recovered wallet keys for many clients from all over the world and you can see some of their raving reviews on Trustpilot where KeychainX has an almost perfect 4.9 ‘Excellent’ score. Read this recent article about how it unlocks different types of wallets and here about specifically recovering keys from Multibit Classic or Multibit HD.
The service covers all kinds of situations such as recovering lost Bitcoin wallets from wallet.dat files, Dogecoin wallet passwords, blockchain second or first passwords, Android wallet or spending PIN, Ethereum from JSON files, and Ethereum presale wallets. KeychainX can even decrypt your blockchain.info 15,17,19 or 21 word mnemonic seed that is no longer supported by blockchain.com itself.
A GPU rig hard at work
KeychainX has shared a client success story that shows how it recovered an old blockchain.info wallet with more than a 12 words story mnemonic seed – something many people mistakenly think is impossible. The client only remembered 17 words out of his mnemonic seed which was used to backup the wallet, and the team had to use a combination of brute force and a lot of “source code archeology” to recover the funds from the no longer supported wallet. The story also shows the lengths that KeychainX is willing to go to for its clients and the amazing ingenuity that is sometimes needed in the process.
To learn more about the company visit KeychainX.io or just send an email to KeychainX@protonmail.com if you need to talk about password recovery.
This is a sponsored post. Learn how to reach our audience here. Read disclaimer below.
Image Credits: Shutterstock, Pixabay, Wiki Commons
Disclaimer: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article.
