Silly error causes hackers to lose a million dollars in crypto
Hacker exploited the vulnerability of the Zeed project and obtained a million USD, but activated the self-destruct feature before withdrawing this amount.
The attack happened on April 22 on a DeFi project called Zeed. After obtaining a large amount of cryptocurrency, the hacker moves into an “attack contract” instead of transferring it to a regular wallet. This is a smart contract written by hackers, with the ability to automatically perform tasks in a very short time and the ability to self-destruct to make it difficult to trace.
However, Zeed’s blog says, 15 seconds after the attack, the hacker activated the self-destruct feature of the contract before taking away the proceeds, leaving the funds locked in the attack contract forever, impossible can be taken out.
According to security firm BlockSec, the attacker “probably activated the self-destruct feature out of excitement” before transferring the funds elsewhere. Looking up on the Bscscan tool, the entire amount of BUSD equivalent to $1.043 million has remained on this contract since the hack happened.
Hackers sell off tokens, making Yeed’s value almost zero.
The attack is considered small-scale and attracts attention because of the hacker’s silly mistake. However, according to experts, the incident continues to show the insecurity of many DeFi projects.
In Zeed’s case, hackers exploited a vulnerability in the project’s “fast loan” protocol. This method allows users to borrow money without collateral to buy and sell tokens, then have to repay immediately in the same transaction block and take a 5% fee. This fee should have been split into three parts to reward liquidity providers. However, due to Zeed’s error, the system did not distribute the rewards, leading to an additional supply of three times the expected amount of tokens. Hackers sold off this token, making its value almost zero.
Luu Quy
at Blogtuan.info – Source: vnexpress.net – Read the original article here
