Ankr blâme l'exploitation de $5 millions sur un ancien employé

• Ankr previously acknowledged that a stolen deployer key that was used to update the protocol’s smart contracts was behind the attack. However, it did not reveal how the deployer key was obtained at the time.

---

The Ankr team, which on December 1 suffered a $5 million hack, has announced on its website that a former employee was responsible for the attack on the protocol. The DeFi platform a dit that the former team member was able to carry out the supply chain attack by inserting harmful code into a package of upcoming updates to the team’s internal software. The malicious code, once updated, produced a security flaw that gave the attacker access to the platform’s server and stole the team’s deployer key.

La faille a permis à un utilisateur de frapper 6 quadrillions de jetons aBNBc, que le pirate rapidement convertis en Binance Coin (BNB) avant de les envoyer à Tornado Cash, un service de mixage crypto. L'attaquant a pu échanger les jetons BNB contre 5 millions USDC.

Ankr said it has notified the appropriate authorities and is working to have the attacker prosecuted. The team is also working to improve security to safeguard future access to its keys. The team said in a statement,

L'exploit a été possible en partie parce qu'il y avait un point de défaillance unique dans notre clé de développeur. Nous allons maintenant implémenter l'authentification multi-signatures pour les mises à jour qui nécessiteront l'approbation de tous les dépositaires de clés pendant des intervalles limités dans le temps, ce qui rendra une future attaque de ce type extrêmement difficile, voire impossible. Ces fonctionnalités amélioreront la sécurité du nouveau contrat ankrBNB et de tous les jetons Ankr.

4/ Nous améliorons actuellement plusieurs mesures de sécurité, en voici quelques-unes :

– Requiring Multi-sig authentication & timelocks for all updates
– Revamping internal security measures
– Implementing new monitoring and notification systems
– Refining procedures for working with DeFi protocols

— Ankr Staking (@ankrstaking) 20 décembre 2022

Furthermore, Ankr has pledged to enhance HR procedures and will mandate that all workers, including those who work remotely, face increased background checks. The team also promised to review access privileges to ensure that only employees who need access to critical information will have clearance to access it. The DeFi protocol also plans to install new notification systems to notify the staff more promptly if a problem occurs.

Dernières nouvelles