Tough day for everyone on Solana today, but here's a breakdown of what we know:
1/ At approximately 22:37 UTC yesterday a hacker began a widespread exploit, the extent of which has so far affected $4M+ of assets from 9.2k+ unique wallets.
1/ At approximately 22:37 UTC yesterday a hacker began a widespread exploit, the extent of which has so far affected $4M+ of assets from 9.2k+ unique wallets.
2/ During the initial phase, funds were extracted at an aggressive pace with hundreds of thousands of dollars being lost minute to minute (all sizes here are converted to USD).
At 23:19 as we thought things were subsiding, another enormous outflow occurs in the order of $1-2M.
At 23:19 as we thought things were subsiding, another enormous outflow occurs in the order of $1-2M.
3/ I can't be certain if something changed in their strategy or whether they just happened to stumble across a number of large wallets (requires more digging).
As you can see at both peaks the average size of transactions is orders of magnitude higher, and predominantly in USDC.
As you can see at both peaks the average size of transactions is orders of magnitude higher, and predominantly in USDC.
4/ In terms of the rate of wallets being affected, there was a large outflow (SOL, USDC mostly) to begin with (note differing timescale here).
This dropped off after the first hour, but many smaller SOL and altcoin (not captured here) transfers continued for many hours post.
This dropped off after the first hour, but many smaller SOL and altcoin (not captured here) transfers continued for many hours post.
5/ Not too surprisingly, of the $4M+ that was stolen we can see that over 95% of that was USDC and SOL. There is definitely a longer tail of altcoins that have also been hit, but I'll leave that as an exercise to the reader.
6/ Over 9.2k wallets were affected, making it a much more widespread attack than others we've traditionally seen.
Some of the wallets hit biggest getting drained of up to 250k worth of assets. Painful reminder to get into the habit of using cold wallets!
Some of the wallets hit biggest getting drained of up to 250k worth of assets. Painful reminder to get into the habit of using cold wallets!
7/ So where did the funds go?
Four addresses highlighted here are the recipients of all these funds. But wait... a co-ordinated attack between multiple parties?
Four addresses highlighted here are the recipients of all these funds. But wait... a co-ordinated attack between multiple parties?
8/ Alas, that's not the case here. As @zachxbt correctly pointed out, all four wallets were funded from the same wallet (which is in turn funded from Binance) mere minutes before the hack kicked off.
https://twitter.com/zachxbt/status/1554634062727446540?s=20&t=6X1c-mblp0y4mtSGSttOTg
9/ What could be the reason?
My guess is given this appears to be a compromise on the private keys of individual wallets, he might be enumerating a bunch of them from a key dump in parallel.
A lot of the effort did seem to be surprisingly manual and brute forced however.
My guess is given this appears to be a compromise on the private keys of individual wallets, he might be enumerating a bunch of them from a key dump in parallel.
A lot of the effort did seem to be surprisingly manual and brute forced however.
10/ So what's the root cause of this vulnerability then?
Well the jury still seems to be out. A few suggestions have been thrown around with regards to bugs in digital signature algorithms and vulnerable code library dependencies.
Well the jury still seems to be out. A few suggestions have been thrown around with regards to bugs in digital signature algorithms and vulnerable code library dependencies.
https://twitter.com/aeyakovenko/status/1554752582387544070?s=20&t=IfWg8BrjHCAKK8e00Px1Xw
11/ What we do know, however, is that this has affected a large swathe of wallets, operating systems and devices. It doesn't appear to be unique to one wallet provider either.
https://twitter.com/0xfoobar/status/1554627762807349249
12/ A lot of reports point to mobile wallet seed creation, and it has been shown to have affected both iOS and Android devices alike.
https://twitter.com/aeyakovenko/status/1554745536741138433
13/ If you want to help profile the nature of the hack and give security researchers more data into what might be going on, note your incident down in the following form:
https://twitter.com/samczsun/status/1554724237151154176
15/ Keep up with the latest investigation from the champions here: @aeyakovenko @zachxbt @0xfoobar @officer_cia @samcz
16/ If you want to dig around with the data I've pulled together above, I've made a public Dune dashboard with all the queries open sourced for the community.
dune.com/tristan0x/sola…
dune.com/tristan0x/sola…
@aeyakovenko @zachxbt @0xfoobar @officer_cia @samcz You can also follow updates here:
https://twitter.com/SolanaStatus/status/1554817791605211136?s=20&t=Q3D3hlABFaRQXvgW_l7KZg
17/ From what we're hearing it's becoming clear that all affected users were using Slope wallet, which has been shown to leak private key mnemonics which were almost certainly compromised. Phantom still TBD.
Similar story here:
Similar story here:
https://twitter.com/FatManTerra/status/1554861871559229440?s=20&t=2BJQg-_-3MJERFZsAOCBJQ
18/ Compromise outlined well here:
https://twitter.com/0xfoobar/status/1554881291451088896?s=20&t=T3xOTxIxQ5LlZisosp355g
19/ Mnemonics available in plaintext from the slope API, absolutely cavalier security for a wallet...
https://twitter.com/MoonRankNFT/status/1554911833617641472?s=20&t=G_QbYnzVZ6i6TRUbsirNSA
• • •
Missing some Tweet in this thread? You can try to
force a refresh
