Ankr beschuldigt ehemaligen Mitarbeiter für $5 Millionen Exploit

• Ankr previously acknowledged that a stolen deployer key that was used to update the protocol’s smart contracts was behind the attack. However, it did not reveal how the deployer key was obtained at the time.

---

The Ankr team, which on December 1 suffered a $5 million hack, has announced on its website that a former employee was responsible for the attack on the protocol. The DeFi platform sagte that the former team member was able to carry out the supply chain attack by inserting harmful code into a package of upcoming updates to the team’s internal software. The malicious code, once updated, produced a security flaw that gave the attacker access to the platform’s server and stole the team’s deployer key.

Der Fehler ermöglichte es einem Benutzer, 6 Billiarden aBNBc-Token zu prägen, die die Hacker schnell in Binance Coin (BNB) umgewandelt, bevor sie an Tornado Cash, einen Krypto-Mischdienst, gesendet werden. Der Angreifer konnte die BNB-Token gegen 5 Millionen USDC tauschen.

Ankr said it has notified the appropriate authorities and is working to have the attacker prosecuted. The team is also working to improve security to safeguard future access to its keys. The team said in a statement,

Der Exploit war teilweise möglich, weil es in unserem Entwicklerschlüssel einen Single Point of Failure gab. Wir werden jetzt Multi-Sig-Authentifizierung für Updates implementieren, die in zeitlich begrenzten Intervallen eine Freigabe von allen Schlüsselverwaltern erfordern, was einen zukünftigen Angriff dieser Art extrem schwierig, wenn nicht unmöglich macht. Diese Funktionen werden die Sicherheit für den neuen ankrBNB-Vertrag und alle Ankr-Token verbessern.

4/ Wir verbessern jetzt mehrere Sicherheitsmaßnahmen, hier sind einige:

– Requiring Multi-sig authentication & timelocks for all updates
– Revamping internal security measures
– Implementing new monitoring and notification systems
– Refining procedures for working with DeFi protocols

— Ankr Staking (@ankrstaking) 20. Dezember 2022

Furthermore, Ankr has pledged to enhance HR procedures and will mandate that all workers, including those who work remotely, face increased background checks. The team also promised to review access privileges to ensure that only employees who need access to critical information will have clearance to access it. The DeFi protocol also plans to install new notification systems to notify the staff more promptly if a problem occurs.

Neuesten Nachrichten