Security in WEB3 - Issue 5 : 04-July-2022

Weekly roundup on Security, Developer, Research and resources in WEB3

Jul 4, 2022

Hey Everyone!

Welcome to my fifth issue on Security in WEB3.

If this is the first time you are visiting this newsletter please consider subscribing if you like to read any of the following.

**The total amount of loss shown are approximations and cannot guarantee that those are actual numbers/losses incurred to people/protocol or profit made by the exploiter.**

Permalink for this Issue powered by @OrbisClub

Hacks🤫

go-opera code bug that allows the user to unlock the local account with HTTP/WS enabled
Twitter and YouTube accounts of the British Army were simultaneously hacked and used to promote NFT and crypto scams @web3isgreat
Another serial Twitter accounts hacker - Recently hacked @JRNYclub and @nounsdao
Solana liquidity protocol Crema Finance was exploited for around 69,500 SOL (~$2.3 million) and around $6.5 million worth of stablecoins for a total loss of around $8.8 million in notional value.
Optimism NFT marketplace Quixotic suffers exploit following contract update. The attacker was able to hack the offer feature to drain more than $100,000 in Optimism and USDC.
Public RPC gateway provided by Ankr for Polygon and Fantom were comprised via DNS hijack. Also a report and resources on how to be safe by @officer_cia
Leading NFT marketplace OpenSea has warned customers of possible phishing attacks after reporting a data breach through its email vendor
@cz_binance warns all the platforms that do user data verification amid a likely data breach caused due to a bug in an Elastic Search deployment by a gov agency from now of the ASIAN country
Infamous North Korean hacker group identified as a suspect for $100M Harmony attack
- cointelegraph
- decrypt

Scams😩

CFTC Charges South African Pool Operator and CEO with $1.7 Billion Fraud Involving Bitcoin
The U.S Department of Justice Announces Enforcement Action Charging Six Individuals with Cryptocurrency Fraud Offenses in Cases Involving Over $100 Million in Intended Losses. Including David Saffron(the owner of the Circle Society cryptocurrency investment platform); Michael Alan Stollery(founder and CEO of Titanium Blockchain Infrastructure Services); Emerson Pires, Flavio Goncalves, and Joshua David Nicholas, the two founders and the "head trader" of the EmpiresX cryptocurrency investment platform; Le Anh Tuan, who was one of the individuals behind the "Baller Ape" NFT rug pull in October 2021;
Serial NFT scammer
Fake Mining scams observed by @sniko_ and others at Consensys
LV__Metaverse second rugpull in a week ~$50K