• Press Releases
    • Submit a press release
    • Read All
  • Advertise
  • Contact us
Crypto.com Logo Crypto.com Logo
Bitcoinist.com
No Result
View All Result
  • Bitcoin
    • News
    • Price
    • Businesses
    • Acceptance
    • Technology
    • Investment
    • Regulation
    • Reviews
    • All Bitcoin News
  • Altcoins
    • News
    • Price
    • Ethereum
    • Ripple
    • Litecoin
    • EOS
    • NAGA
    • All Altcoin News
  • Tech
    • Blockchain
    • Security
    • FinTech
  • Industry
    • Press releases
  • Price
    • Bitcoin Price
    • Ethereum Price
    • Litecoin Price
    • Binance Coin Price
    • Monero Price
    • MimbleWimbleCoin Price
  • How to
    • Buy gift cards/mobile Top Ups with Cryptos
    • What Is Bitcoin?
    • Best Bitcoin Wallet
    • Bitcoin vs Ethereum
    • Why Use Blockchain Technology?
    • Bitcoin Cash ABC vs. Bitcoin Cash SV
    • How to Buy Cryptocurrency
    • Bitcoin Mining
    • Best Bitcoin Brokers
    • Best Bitcoin Forex Brokers
    • How To Earn Bitcoin
    • What is Facebook Libra?
    • Ripple and XRP: The Complete Guide
    • Bitcoin Casinos – Where, What and How to Play
  • Play Games
  • BET&WIN
  • Bitcoin Casino Reviews
  • Bitcoin
    • News
    • Price
    • Businesses
    • Acceptance
    • Technology
    • Investment
    • Regulation
    • Reviews
    • All Bitcoin News
  • Altcoins
    • News
    • Price
    • Ethereum
    • Ripple
    • Litecoin
    • EOS
    • NAGA
    • All Altcoin News
  • Tech
    • Blockchain
    • Security
    • FinTech
  • Industry
    • Press releases
  • Price
    • Bitcoin Price
    • Ethereum Price
    • Litecoin Price
    • Binance Coin Price
    • Monero Price
    • MimbleWimbleCoin Price
  • How to
    • Buy gift cards/mobile Top Ups with Cryptos
    • What Is Bitcoin?
    • Best Bitcoin Wallet
    • Bitcoin vs Ethereum
    • Why Use Blockchain Technology?
    • Bitcoin Cash ABC vs. Bitcoin Cash SV
    • How to Buy Cryptocurrency
    • Bitcoin Mining
    • Best Bitcoin Brokers
    • Best Bitcoin Forex Brokers
    • How To Earn Bitcoin
    • What is Facebook Libra?
    • Ripple and XRP: The Complete Guide
    • Bitcoin Casinos – Where, What and How to Play
  • Play Games
  • BET&WIN
  • Bitcoin Casino Reviews
Bitcoinist.com
No Result
View All Result
Hackers Ethereum
Nexo

How This Ethereum Lending Platform Was Attacked And Made A Deal With The Hacker

Reynaldo Marquez by Reynaldo Marquez
2 months ago
in Ethereum
0
Advertisement

Ethereum lending platform XCarnival confirmed a bad actor stole $3.8 million or 3,087 ETH. According to a report from on-chain security firm Peck Shield, a hacker exploited a vulnerability on the protocol’s smart contract by borrowing ETH and creating “multiple pledge orders to pledge BAYC (Bored Ape Yacht Club NFTs) many times”.

Related Reading | Morgan Creek Said To Be In Bid To Secure $250-M To Counter FTX BlockFi Bailout

5 BTC + 300 Free Spins for new players & 15 BTC + 35.000 Free Spins every month, only at mBitcasino. Play Now!

XCarnival operates as a non-fungible token (NFT) lending pool. The platform enables NFT holders to deposit their assets in exchange for liquidity. This process involves three smart contracts: an NFT manager, a P2Controller to manage lending restrictions, and fund storage, as stated by another security firm Go+ Security.

The hacker bought item 5110 from the popular Bored Ape Yacht Club NFT collection on OpenSea. Later, he deposited this asset on XCarnival and conducted an attack to “use the same NFT for borrowing”.

In other words, the attacker was able to pledge the NFT, borrowed ETH, and then remove the NFT without paying back the loan. The bad actor completed this process several times until the pool was drained.

BitStarz Player Lands $2,459,124 Record Win! Could you be next big winner?
Get 110 USDT Futures Bonus for FREE!

Go+ Security explained that the hacker created a Master smart contract and several “slaves” smart contracts to conduct the attack:

Then Slave 5338 withdrew the NFT and sent it back to Master, who then repeated this process with other Slaves. In this way they created many orderIDs, which can later be used as lending credentials. But bugged xNFT contract didn’t revoke the credential after withdrawing.

XCarnival’s operated with a vulnerability on its smart contracts, mentioned above, which enable the attack if the user stays within a certain. Go+ Security added on the attack and the smart contract vulnerability: “Collateral is still valid after withdrawing. This is a very simple & naive bug in contract implementation.”

What is the best crypto casino in July 2022? Read our comprehensive comparison! We made deposits, played and reviewed 80+ crypto casinos to choose the best one.

In light of the successful attack, the Ethereum-based NFT lending protocol decided to offer the hacker a deal.

Ethereum Platform Makes Deals With Its Attacker

According to its official Twitter account, the XCarnival offered the hacker a 1,500 ETH or $1.8 million bounty. Half the stolen funds. The attacker only needed to return the other half and they got to keep the money and suffer no legal consequences.

The team behind the platform confirmed that the hacker agreed to the terms. Half the stolen funds were returned to the pool. The Ethereum lending platform claims “security agencies have tentatively determined the hacker’s geographic location”.

This statement seems to hint at possible legal consequences for the attacker, but the team behind this project is yet to provide more information.

7/8 Funds returnedhttps://t.co/oRwSsGgT6U pic.twitter.com/YgXZ9DTj03

— Tal Be'ery (@TalBeerySec) June 27, 2022

This is not the first time a hacker agrees to return a portion or the full amount of the stolen funds. Some hackers attack decentralized finance (DeFi) platforms and often held the money hostage until they receive payment for what they considered to be a “service”. Other projects are less lucky and pay the ultimate price.

Related Reading | Harmony Dangles $1M Reward For Return Of $100M Stolen Funds – Is It Enough?

At the time of writing, Ethereum (ETH) trades at $1,180 with a 3% loss in the last 24 hours.

Ethereum ETH ETHUSD
ETH moving sideways on the 4-hour chart. Source: ETHUSD Tradingview
ShareTweetShareShare

Sign Up for Our Newsletter!

For updates and exclusive offers enter your email.

I consent to my submitted data being collected and stored.
Reynaldo Marquez

Reynaldo Marquez

Related Posts

Ethereum

Merge Effects Continue As Ethereum Futures Prices Fall To All-Time Lows

20 hours ago
ETHPoW, a "Work Hard" sign

Proposed ETHPoW Fork Poses An Existential Threat To Ethereum. Can It Succeed?

2 days ago
Ethereum

What The Impending “Triple Halvening” Means For The Future Of Ethereum

2 days ago
Crypto payments Vitalik Buterin

Here’s Why Vitalik Buterin Believes Crypto Payments Will Become Mainstream

3 days ago
Ethereum

Ethereum Merge: The Past, The Present, And The Future

1 week ago
Ethereum Mining

Why Are Ethereum Miners Worried About The Merge?

1 week ago

Bitcoin news portal providing breaking news, guides, price analysis about decentralized digital money & blockchain technology.

Bitcoin

  • News
  • Price
  • Businesses
  • Acceptance
  • Technology
  • Investment
  • Regulation
  • Reviews

Altcoins

  • News
  • Price
  • Ethereum
  • Ripple
  • Litecoin
  • EOS
  • NAGA

Categories

  • Blockchain
  • Security
  • FinTech
  • Technology
  • Trending
  • Breaking News
  • Press Releases
  • How to

Pages

  • Contact us
  • Editorial Policy
  • Advertise
  • Crypto Prices from Nomics
© 2022 Bitcoinist.com. All Rights Reserved.
  • Bitcoin
    • News
    • Price
    • Businesses
    • Acceptance
    • Technology
    • Investment
    • Regulation
    • Reviews
    • All Bitcoin News
  • Altcoins
    • News
    • Price
    • Ethereum
    • Ripple
    • Litecoin
    • EOS
    • NAGA
    • All Altcoin News
  • Tech
    • Blockchain
    • Security
    • FinTech
  • Industry
    • Press releases
  • Price
    • Bitcoin Price
    • Ethereum Price
    • Litecoin Price
    • Binance Coin Price
    • Monero Price
    • MimbleWimbleCoin Price
  • How to
    • Buy gift cards/mobile Top Ups with Cryptos
    • What Is Bitcoin?
    • Best Bitcoin Wallet
    • Bitcoin vs Ethereum
    • Why Use Blockchain Technology?
    • Bitcoin Cash ABC vs. Bitcoin Cash SV
    • How to Buy Cryptocurrency
    • Bitcoin Mining
    • Best Bitcoin Brokers
    • Best Bitcoin Forex Brokers
    • How To Earn Bitcoin
    • What is Facebook Libra?
    • Ripple and XRP: The Complete Guide
    • Bitcoin Casinos – Where, What and How to Play
  • Play Games
  • BET&WIN
  • Bitcoin Casino Reviews

© 2021 Bitcoinist. All Rights Reserved.

This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy Center or Cookie Policy.