The decentralized finance (DeFi) sector has just endured yet another multi-million-dollar breach.
According to alerts from prominent blockchain security firms SlowMist and PeckShield, hackers managed to drain approximately $5.9 million in Ethereum, Wrapped Bitcoin (WBTC), and stablecoins from trading protocol Trusted Volumes, which acts as liquidity provider for 1inch.
This has happened due to a fundamental flaw in the protocol’s core signature validation logic. The flaw has made it possible for the attacker to bypass authorization checks and forge trading orders.
HOT Stories Zcash (ZEC) Is Crypto's Number One, Toncoin (TON) Dwarfs Solana (SOL), XRP Finally Breaks Key Resistance, but What's Early: Crypto Market Review Bollinger's Model Says 'Buy' Bitcoin
A fatal flaw
Trusted Volumes is a DeFi trading protocol built upon a Request for Quote (RFQ) architecture. They operate similarly to decentralized Over-The-Counter (OTC) desks.
An RFQ system facilitates peer-to-peer trading, which sets it apart from traditional Automated Market Makers (AMMs) like Uniswap.
A "taker" requests a price quote, and a "maker" offers a firm price. Both parties cryptographically sign the order, and the smart contract settles the swap. Users have to grant the protocol broad approval to move their funds. Hence, flawless cryptographic signature verification is essential for the security of an RFQ network.
In this case, the devastating security breach was caused by a logical error within the protocol's fillOrder function.
According to PeckShield, the total haul amounted to $5.9 million. SlowMist's autopsy of the drained assets revealed a massive pile consisting of 1,291 ETH ($3.02 million), 16.94 WBTC ($1.37 million), 1.26 million USDC, and 206,000 USDT.
The bad actor immediately started laundering the stolen funds (to no one's surprise). On-chain data confirms the attacker laundered the stolen stablecoins and Wrapped Bitcoin through a decentralized exchange.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
