Decentralized cryptocurenncy loan platform 'Lendf.Me' suffered a security breach on April 18th, around $25 million worth of cryptocurrency was stolen.
Using an exploit in the DeFi smart contracts, the callback mechanism enabled the hacker to withdraw ERC777 tokens repeatedly, this exploit allows them to drain the account without the new balance being immediately updated and showing the theft, until it's too late.
Upon discovering this, things couldn't have looked any worse, as the CEO publicly made this depressing statement while sharing the news:
"This attack not only harmed our users, our partners, and my co-founders, but also me personally. My assets were stolen in this attack, too.
This attack was my failure. While I did not execute it, I should have anticipated it and taken actions to prevent it. My heart goes out to everyone harmed, and I will do everything in my power to make this right. I sincerely apologize to our users, to our new investors, and to my team for letting them down."
While it sounded like the company was down and out, possibly forever - this was just the beginning of the story.
The site's CEO Mindao Yang wanted to try negotiating, so he had his team leave a note for the hackers on the blockchain, saying "Contact us. For your better future" along with their direct contact information.
An Aggressive Counterattack...
Here's where they got it right - instantly their team sprang into action, bringing in security firm SlowMist, which specializes specifically in blockchain based cybersecurity, along with the Singapore Police.
They then announced on their social media that the process of tracking down the hackers had begun.
While we don't know what (if anything) was left behind as far as clues that could lead to the hackers, the company began a campaign to put them in a state of paranoia, stating on their site that there were 'traces left by the hackers before and after the attack' allowing them to 'cross-check with the resources of various parties at home and abroad to obtain breakthrough clues, getting closer to the hacker'.
At the same time, they began contacting other exchanges and making them aware of the hack, getting them to blacklist and freeze any wallets receiving the stolen coins.
The Hackers Couldn't Handle The Heat...
The stress was too much, and the hackers began to crack - the combo of a security firm in the process of tracking them down, and the coins becoming hard to spend as more exchanges blacklisted them, led the hackers to deciding it just wasn't worth it anymore.
They began returning some of the stolen crypto, then something must have really spooked them - the following day they sent back everything they had left.
Amazingly, Nearly All Of the $25 Million Was Recovered...
While the company stated 'all' the assets had been recovered, we were only able to verify $24 of the original $25 million as being returned. But we won't bother getting hung on a tiny $1 million lost, this was still a job well done!
Any users with funds stolen have been promised 100% will be returned.
The company is now bringing in 3rd party experts to both analyze what went wrong here, and what needs to be done to fortify their security in the future.
It's safe to assume this is was part of the deal with the hackers - the company has withdrawn their request to press charges with the Singapore Police.
-------
Author: Ross Davis
E-Mail: Ross@GlobalCryptoPress.com Twitter:@RossFM
San Francisco News Desk
No comments
Post a Comment