On Wednesday evening, funds were stolen from several cryptocurrency wallets linked to BadgerDAO’s decentralized finance platform. According to the blockchain security and data analytics Peckshield, which is working with Badger to investigate the heist, the various tokens stolen in the attack are worth about $120 million.
While the investigation is ongoing, Badger team members have informed users that they believe the problem was caused by someone inserting malicious code in their website’s UI. Any users who interacted on the site while the script was active would see the script intercept Web3 transactions and insert an request to send the victim’s tokens.
We can see the transaction details and what happened after the attackers attacked. PeckShield points out one transfer that yanked 896 Bitcoin into the attacker’s coffers, worth more than $50 million. According to the team, the malicious code appeared as early as November 10th, as the attackers ran it at seemingly random intervals to avoid detection.
Decentralized finance (or DeFi) systems rely on blockchain technology to let crypto owners perform more typical finance operations like earning interest via lending. BadgerDAO claims that users can rest easy knowing they don’t have to give up their crypto keys, they can withdraw whenever they like, and it has a protocol that allows anyone with Bitcoin to “bridge” their cryptocurrency to the Ethereum platform through its token. This will allow them to take advantage of DeFi opportunities which they might otherwise not be able to access.
For now, smart contracts are still in pause to prevent any withdrawals. Badger will provide further updates as soon they become available.
— BTCadgerDAO (@BadgerDAO) December 2, 2021
Once Badger became aware of the unauthorized transfers, it paused all smart contracts, essentially freezing its platform, and advised users to decline all transactions to the attacker’s addresses.
Thursday night, the company said it has “retained data forensics experts Chainalysis to explore the full scale of the incident & authorities in both the US & Canada have been informed & Badger is cooperating fully with external investigations as well as proceeding with its own.”
One of the things Badger is investigating is how the attacker apparently accessed Cloudflare via an API key that should’ve been protected by two-factor authentication. Although the attacker didn’t find any flaws in Blockchain tech, the attack did exploit an older technology called “web 2.0” that most users use to make transactions. Multi-factor authentication protects our accounts from many phishing schemes and bulk credential stuffing. Still, experts have repeatedly warned about targeted phishing attacks that can bypass it, while toolkits to automate the process have been available for years. An FBI notice in 2019 (pdf) called out criminals’ growing capabilities to bypass MFA and suggested changes or training that could make such attacks harder to pull off.
Getting two-factor authentication right can be tricky even within typical financial applications — just ask PayPal. But incidents like this one, or the stolen-and-returned $600 million hijack that Poly Network suffered in August, or the $53 million heist that hit the first DAO ever in 2016, are hopefully enough to expand awareness of security beyond protocols and encryption.
One commenter within Badger’s Discord summed up the situation by saying, “All [the] blockchain / smart contract audits in the world, and people lose 120m to a Cloudflare API leak by a sloppy team where a dude passes a new approval to his contract in the site header – GG – we still have a long way to go.” A member of the team said, “I’m sure we will have some mitigation procedures proposed after this.”
What funds can be recovered and how those affected will be made whole is still unknown. It is unclear how funds can be recovered and who will be compensated. However, anyone working in crypto, blockchain, or Web3 apps should learn how transactions, approvals, and signing work, and keep an eye out for suspicious activity. Even though millions of dollars can be lost in an instant, even though they are managed by one of the most secure teams in DeFi, Badger says.
Crypto/security people: we can’t *possiblyrun a secure messaging app over the web because everything’s too insecure!
— Matthew Green (@matthew_d_green) December 2, 2021