Ankr culpa o ex-funcionário pelo exploit de $5 milhões
- Ankr previously acknowledged that a stolen deployer key that was used to update the protocol’s smart contracts was behind the attack. However, it did not reveal how the deployer key was obtained at the time.
The Ankr team, which on December 1 suffered a $5 million hack, has announced on its website that a former employee was responsible for the attack on the protocol. The DeFi platform disse that the former team member was able to carry out the supply chain attack by inserting harmful code into a package of upcoming updates to the team’s internal software. The malicious code, once updated, produced a security flaw that gave the attacker access to the platform’s server and stole the team’s deployer key.
A falha permitiu que um usuário cunhasse 6 quatrilhões de tokens aBNBc, que o hacker rapidamente convertidos em Binance Coin (BNB) antes de enviá-los para o Tornado Cash, um serviço de mixagem de criptomoedas. O invasor conseguiu trocar os tokens BNB por 5 milhões de USDC.
Ankr said it has notified the appropriate authorities and is working to have the attacker prosecuted. The team is also working to improve security to safeguard future access to its keys. The team said in a statement,
A exploração foi possível em parte porque havia um único ponto de falha em nossa chave de desenvolvedor. Agora vamos implementar a autenticação multi-sig para atualizações que exigirão a aprovação de todos os responsáveis pela chave durante intervalos de tempo restrito, tornando um ataque futuro desse tipo extremamente difícil, se não impossível. Esses recursos melhorarão a segurança do novo contrato ankrBNB e de todos os tokens Ankr.
Furthermore, Ankr has pledged to enhance HR procedures and will mandate that all workers, including those who work remotely, face increased background checks. The team also promised to review access privileges to ensure that only employees who need access to critical information will have clearance to access it. The DeFi protocol also plans to install new notification systems to notify the staff more promptly if a problem occurs.
Cobri algumas histórias interessantes em minha carreira como jornalista e acho as histórias relacionadas ao blockchain muito intrigantes. Acredito que a Web3 vai mudar o mundo e quero que todos façam parte dele.
