A phishing attack led a hacker to get his hands on approximately $55 million worth of cryptocurrency. The spear-phishing attack on an employee of decentralized finance (DeFi) platform bZx gave the attackers two private keys used by the platform to integrate with the Polygon and Binance Smart Chain (BSC) blockchains.
See also: US: Sanctions imposed on cryptocurrency exchange Suex
“After gaining control of BSC and Polygon, the hacker drained the BSC and Polygon protocol and then upgraded the contract to allow the draining of all tokens that the contracts had given unlimited approval to,” the platform noted in its initial investigation into the incident.
While bZx has yet to comment on the amount of funds stolen, reporting on the incident, blockchain security firm SlowMist estimates the amount to be close to $55 million, based on the malicious transactions it has detected.
See also: Cryptocurrency scam, themed around Elon Musk, is being distributed via emails
Million dollar robbery
According to the platform, a bZx developer was apparently sent a phishing email with a malicious macro in a Microsoft Word, disguised as a legitimate email attachment. The infected attachment ran a script that gave the attackers the developer’s personal cryptocurrency wallet mnemonic.
The attack then escalated once the hackers captured the two private keys. In addition to the developer’s funds, the attack also affected lenders, borrowers, and farmers with funds in Polygon and BSC, as well as those who had given unlimited approvals to these contracts.
See also: PayPal's cryptocurrency service available in the UK
As the platform works to compile a specific list of affected wallets, it has disabled the ability to deposit new funds. bZx said it is working with various cryptocurrency exchanges to “track the attacker, freeze and potentially recover the stolen funds.”.
Additionally, the platform posted a message asking the attacker to return the funds, in the same vein as the PolyNetwork incident, where the hacker returned all of the stolen cryptos worth $600 million.
Information source: techradar.com
