Top

Crypto vulnerability uncovered with $1B in digital asset exposure

Policy & Regulation·November 22, 2023, 3:00 AM

Security vulnerabilities in the validator infrastructure of InfStones, an established infrastructure provider, have been disclosed by Tel Aviv-headquartered cybersecurity firm dWallet Labs.

Photo by Brett Jordan on Unsplash

 

Blockchain network validator vulnerability

In a detailed Medium blog post published on Tuesday, dWallet Labs shed light on a series of vulnerabilities that, when exploited, could potentially allow attackers to gain full control, execute code and extract private keys from numerous validators on major blockchain networks. Cryptocurrencies such as ETH, BNB, SUI, APT and others were identified as at risk, with potential direct losses estimated to exceed one billion dollars.

The vulnerabilities discovered by dWallet Labs opened the door for attackers to compromise the private keys of validators across multiple blockchain networks, putting over one billion dollars of staked assets at risk. In response to the findings, InfStones, a Web3 infrastructure platform, also released a statement on Tuesday acknowledging the potential threat. However, its representative, Darko Radunovic, disputed the figures provided by dWallet Labs in a statement sent to Cointelegraph. Radunovic stated that the vulnerabilities identified in the production environment account for below 0.1% of their active nodes launched to date, emphasizing that the impact would be limited to a small fraction of their operational nodes.

According to InfStones, “237 instances were in scope, of which 212 instances were deployed for our development and testing purposes, and 25 freshly deployed instances in the production environment.”

 

Mitigating steps taken

The company detailed the immediate actions taken to mitigate the vulnerabilities, including shutting down the affected ports, as well as rotating all credentials and keys within their platform. An internal review conducted by InfStones revealed no additional adverse effects. Notwithstanding that, the company took the additional step of hiring an external security firm to audit its systems and policies.

Meanwhile, dWallet Labs Founder and CEO Omer Sadika shared his thoughts on the X platform as to how he believes such events should be handled. Sadika wrote:

”The worst way to handle a cybersecurity vulnerability is not taking responsibility and lying. We were super open and transparent with the goal of eliminating the risk to web3. My take: it’s not about whether you are fully secure or not, because no one is, it’s about how you handle it and maintain the trust with your partners and customers.”

The collaboration between dWallet Labs and InfStones sheds light on the ongoing challenges faced by the cryptocurrency industry in maintaining the security and integrity of blockchain networks. While vulnerabilities were identified and addressed, the incident underscores the importance of proactive security measures to safeguard the assets and data within the rapidly evolving landscape of digital assets.

More to Read
View All
Web3 & Enterprise·

Jul 20, 2023

p0x Labs Secures $25M Funding to Propel Manta Network Into Asia

p0x Labs Secures $25M Funding to Propel Manta Network Into Asiap0x Labs, the development team behind Manta Network, has successfully raised $25 million in a Series A funding round that will see the project expand into the Asian market.Photo by Towfiqu barbhuiya on Unsplash$500 million valuationThe funding round, led by Polychain Capital and Shanghai-headquartered Qiming Venture Partners, has resulted in a valuation of $500 million for p0x Labs, according to a blog post published by the project on Wednesday. This equity-based investment demonstrates a growing interest in not only the project’s token but also the team behind it.Manta Network aims to leverage zero-knowledge (ZK) technology to address the scalability challenges and privacy concerns prevalent on the Ethereum network. By harnessing zero-knowledge proofs, Manta enables users to verify the authenticity of information without disclosing the underlying data.This approach provides individuals with complete control over their identities while mitigating the risks of surveillance. Consequently, Manta Network is seeking to attract users who have reservations about utilizing DeFi protocols due to the transparent nature of transactions on public blockchain networks.At the recent EthCC event held in Paris, the project unveiled the testnet for its Layer 2 network, known as Manta Pacific. This testnet operates in an environment with low gas fees, fostering cost-effective transactions for users. Manta Pacific is designed to complement the existing Layer 1 solution, Manta Atlantic, which focuses on achieving compliant on-chain privacy.VC supportLuke Pearson, an investor at Polychain Capital, expressed his enthusiasm for Manta Network’s expansion within the Ethereum ecosystem and confirmed Polychain’s continued support through this Series A funding round. Meanwhile, Yi Tang, Principal at Qiming Venture Partners, believes that their contribution will not only help Manta Network penetrate the Asian market but also attract the attention of Web2 brands.With the additional funding, p0x Labs aims to establish a global presence for Manta Network. Kenny Li, a core contributor at Manta Network, emphasized the significance of partnering with one of China’s largest investors to gain a stronger foothold in Asia, particularly China. The team is enthusiastic about the opportunities this collaboration will bring.Industry partnershipsManta Network has already witnessed substantial demand for its offerings, with partnerships with projects such as Arbitrum and Linea resulting in the creation of over 300,000 zero-knowledge soulbound tokens. These tokens enable the verification of on-chain identities without compromising data confidentiality. Additionally, the native Manta Wallet has garnered more than 200,000 installations, and innovative features like email-based notifications have contributed to a collective user base exceeding 1.5 million users.Looking ahead, the newly launched testnet with its plug-and-play functionality is expected to streamline the development process for Manta Network’s ecosystem. Developers will be able to allocate their time and resources more efficiently toward building their core products, driving innovation within the zero-knowledge space.The successful funding round and the launch of the Layer 2 testnet mark significant milestones for Manta Network and p0x Labs. With continued support from prominent investors, Manta Network appears to be setting itself up to unlock the true potential of zero-knowledge technology and drive adoption across various industries.

news
Policy & Regulation·

Mar 09, 2024

Further details emerge on Philippine CBDC project

The Philippines is on track to finalize Project Agila, its wholesale central bank digital currency (CBDC) trial, by the end of this year. Three primary use casesThat’s according to statements made on March 6 by Deputy Governor Mamerto Tangonan of the Bangko Sentral ng Pilipinas (BSP) —  the Philippine central bank. According to a local news report by GMA News, the Deputy Governor outlined three primary use cases for the wholesale CBDC trials in a press conference: interbank settlement, settlement of securities transactions and cross-border payments. Notably, the Philippines is participating as an observer in the cross-border CBDC project mBridge, which involves China, Hong Kong, Thailand and the United Arab Emirates (UAE). Six domestic institutions are involved in the current tests in the Philippines: BDO Unibank, China Banking Corp, Land Bank of the Philippines, Rizal Commercial Banking, Union Bank of the Philippines and Maya Philippines.Photo by OJ Serrano on UnsplashUsing pilot as ‘learning exercise’Tangonan described the pilot as a "learning exercise in order to put us in a better position to assess whether this technology is what, itself, claims to be.” Typically, central bank accounts are restricted to commercial banks and some central counterparties in financial markets. However, the BSP intends for the wholesale CBDC to be accessible to banks and certain financial institutions. Nevertheless, past tests, including one in Canada, have highlighted potential limitations, such as the inability of brokers to use the wholesale CBDC for settlement. An ongoing interest since 2020The Philippines initially expressed interest in issuing a CBDC in 2020, with the BSP Monetary Board conducting a positive initial assessment of a wholesale CBDC and planning pilot tests from 2022 onwards, known then as Project CBDCPh. The launch of the pilot project was announced in April 2022. In 2023, the Southeast Asian country participated in a pilot study with the Digital Dollar Project, Western Union and BDO Unibank to explore a retail CBDC for remittance purposes. While the study found potential cost reductions and increased transparency and competition, it also identified challenges related to transaction speed, particularly due to most remittances arriving after working hours. Moving away from blockchainLast September, the BSP announced plans to utilize the Hyperledger Fabric blockchain. However, in February, Governor Eli Remolona stated that the CBDC would not be utilizing blockchain technology. At that time, the central bank Governor had indicated the expectation of launching a wholesale CBDC either next year or by 2026. Elsewhere in the Asian region, the Hong Kong Monetary Authority (HKMA) recently announced its own wholesale CBDC trials, Project Ensemble, underscoring the growing interest and activity in CBDC development across various jurisdictions. The Chinese autonomous territory is also cooperating with its colleagues in mainland China in participating in testing of the digital yuan or e-CNY, with a particular focus on cross-border payments.India represents another key Asian nation which has devoted quite a lot of time and resources to CBDC development already. However, a report last month suggested that the world’s most populous country has concerns with regard to the question of privacy relative to CBDC use. For that reason, it has determined the need to remain cautious while continuing CBDC development.  

news
Web3 & Enterprise·

Dec 20, 2023

Samjong KPMG and Xangle to explore on-chain data for crypto accounting

Samjong KPMG and Xangle to explore on-chain data for crypto accountingSamjong KPMG, the South Korean branch of accounting giant KPMG, is set to collaborate with digital asset data research platform Xangle to conduct a joint study focused on discovering different ways to apply on-chain data in the realm of cryptocurrency accounting. That’s according to a report by local news outlet The Korea Economic Daily.On-chain data encompasses all transaction records found on a blockchain. This type of data enables real-time verification of transactions, benefiting from the blockchain’s transparency and decentralized framework. Despite these advantages, the complexity of accessing and interpreting on-chain data is often seen as a barrier to entry, requiring specialized knowledge.Photo by Sasun Bughdaryan on UnsplashCrypto accounting and tax filingThe partnership between the two entities is poised to tackle challenges in the crypto sector faced by enterprises. Samjong KPMG will use this collaboration to improve their cryptocurrency consulting services, offering solutions in areas like virtual asset issuance, asset management and disclosure, internal controls and the accounting and tax filing complexities associated with cryptocurrencies.ERP solutions for virtual assetsMeanwhile, Xangle will have the opportunity to gain insights into the practical needs and concerns of businesses in relation to on-chain data as the company is currently developing enterprise resource planning (ERP) solutions for virtual assets. The joint effort will enhance Xangle’s ability to align technical data with real-world business applications.Park Sung-bae, a Partner at Samjong KPMG, commented on this development, stating that the accounting firm plans to utilize the outcomes of their joint study with Xangle to address the uncertainties surrounding virtual asset disclosure requirements. This initiative is aimed at improving accounting transparency within South Korea’s cryptocurrency market.Lee Hyun-woo, Co-CEO of Xangle, highlighted that the company has concentrated on establishing the necessary infrastructure for processing on-chain data and conducting research to deepen their understanding of it. He added that their latest collaboration with Samjong KPMG will enhance Xangle’s expertise in the areas of cryptocurrency taxes and accounting. Lee underlined the platform’s commitment to streamlining the accounting processes related to virtual assets, viewing it as an initial step towards facilitating broader Web3 adoption.

news
Loading