Top

Crypto vulnerability uncovered with $1B in digital asset exposure

Policy & Regulation·November 22, 2023, 3:00 AM

Security vulnerabilities in the validator infrastructure of InfStones, an established infrastructure provider, have been disclosed by Tel Aviv-headquartered cybersecurity firm dWallet Labs.

Photo by Brett Jordan on Unsplash

 

Blockchain network validator vulnerability

In a detailed Medium blog post published on Tuesday, dWallet Labs shed light on a series of vulnerabilities that, when exploited, could potentially allow attackers to gain full control, execute code and extract private keys from numerous validators on major blockchain networks. Cryptocurrencies such as ETH, BNB, SUI, APT and others were identified as at risk, with potential direct losses estimated to exceed one billion dollars.

The vulnerabilities discovered by dWallet Labs opened the door for attackers to compromise the private keys of validators across multiple blockchain networks, putting over one billion dollars of staked assets at risk. In response to the findings, InfStones, a Web3 infrastructure platform, also released a statement on Tuesday acknowledging the potential threat. However, its representative, Darko Radunovic, disputed the figures provided by dWallet Labs in a statement sent to Cointelegraph. Radunovic stated that the vulnerabilities identified in the production environment account for below 0.1% of their active nodes launched to date, emphasizing that the impact would be limited to a small fraction of their operational nodes.

According to InfStones, “237 instances were in scope, of which 212 instances were deployed for our development and testing purposes, and 25 freshly deployed instances in the production environment.”

 

Mitigating steps taken

The company detailed the immediate actions taken to mitigate the vulnerabilities, including shutting down the affected ports, as well as rotating all credentials and keys within their platform. An internal review conducted by InfStones revealed no additional adverse effects. Notwithstanding that, the company took the additional step of hiring an external security firm to audit its systems and policies.

Meanwhile, dWallet Labs Founder and CEO Omer Sadika shared his thoughts on the X platform as to how he believes such events should be handled. Sadika wrote:

”The worst way to handle a cybersecurity vulnerability is not taking responsibility and lying. We were super open and transparent with the goal of eliminating the risk to web3. My take: it’s not about whether you are fully secure or not, because no one is, it’s about how you handle it and maintain the trust with your partners and customers.”

The collaboration between dWallet Labs and InfStones sheds light on the ongoing challenges faced by the cryptocurrency industry in maintaining the security and integrity of blockchain networks. While vulnerabilities were identified and addressed, the incident underscores the importance of proactive security measures to safeguard the assets and data within the rapidly evolving landscape of digital assets.

More to Read
View All
Policy & Regulation·

Dec 05, 2024

Indian government claims Binance isn’t tax compliant

According to India’s Finance Ministry, Binance and a number of other virtual asset service providers (VASPs) are not tax-compliant in India. Cases of tax evasion detectedNews of this matter emerged via written answers, published on Dec. 2, provided in response to parliamentary questions which had been put to India’s Finance Minister, Pankaj Chaudhary. The minister confirmed that a “few cases of evasion of Goods and Services Tax (GST) by cryptocurrency exchanges and investors” had been detected. The document goes on to list 17 crypto entities who are currently being investigated on that basis, with Binance being the most well-known among them. Notable Indian exchanges listed include WazirX, CoinDCX and CoinSwitch. Chaudhary included details of cases booked against these exchanges. In Binance’s case, it was required to pay 722 crore Indian rupees, which amounts to around $85.2 million. While Binance doesn’t appear to have incurred penalties, in the case of WazirX, the exchange had an assessed tax shortfall of 40.51 crore Indian rupees ($4.78 million), but after fees and interest, it was provided with a demand for 49.19 crore Indian rupees ($5.8 million). CoinDCX and CoinSwitch were also assessed with a demand for 20.86 crore Indian rupees ($2.46 million) and 19.38 crore Indian rupees ($2.28 million), inclusive of penalties and interest. In the case of WazirX, CoinDCX and CoinSwitch, the exchanges have had to pay an additional 21%, 24% and 37% respectively in fees and interest over and above their original tax liabilities.Photo by Naveed Ahmed on UnsplashPrevious tax and regulatory issuesTo date, the Finance Ministry has recovered 122.3 crore rupees ($14.4 million) as part of these investigations. Binance has as yet not paid the funds demanded by the authorities. It emerged in August that India’s Directorate General of Goods and Services Tax Intelligence (DGGI) had imposed an $86 million tax demand on the company, with Binance contesting the assessment. The global crypto exchange platform had previously paid a $2.5 million fine for having engaged with Indian customers despite not having been approved by the authorities to trade within the country. After a number of months during which it didn’t trade within the Indian market, in August Binance regularized its standing and gained approval to trade. In a request for comment on the matter from Cointelegraph, a Binance representative stated: “We continue to work closely with regulatory authorities and attend necessary hearings to address any concerns and questions. Binance remains responsive and cooperative and is committed to addressing all necessary tax inquiries.” The company recently hired UK-based accounting and business advisory firm Grant Thornton to assist with accounting, tax and audit preparedness. In the case of WazirX, a spokesperson said that “GST law on cryptocurrencies was not clear in India,” and that on this basis, the company found itself being assessed for non-payment of the applicable taxes.

news
Web3 & Enterprise·

Oct 23, 2023

Korea’s ABB Joins Hands with Vietnam’s DTS Group for Web3 Development

Korea’s ABB Joins Hands with Vietnam’s DTS Group for Web3 DevelopmentSouth Korean Web3 consulting firm ABB announced Monday that it has signed a comprehensive memorandum of understanding (MOU) with DTS Group, one of the fastest-growing companies in Vietnam.The agreement was signed at the 20th World Web 3.0 NFT META Marvels Bangkok 2023 conference held in the Thai capital last Friday, with ABB’s CEO, Jung Joo-pil, and DTS Group’s Chairman, Truong Gia Bao, in attendance.Photo by Shubham Dhage on UnsplashFostering Web3 innovation and diplomatic tiesThis collaboration is expected to contribute significantly to the development of Web3 in both Korea and Vietnam. They will start by discovering and investing in promising blockchain startups and expand into more diverse business areas, then further enhance their cooperation in Web3 technology development and promotional marketing in the future.About ABB and DTS GroupABB is primarily engaged in consulting, promotional marketing, and fundraising for blockchain-related projects. It is widely known as the publisher of the Korean blockchain monthly magazine Blockchain Today, through which it contributes to the growth of the Korean blockchain industry.DTS Group, on the other hand, is one of the fastest-growing firms in Vietnam and operates via four main subsidiaries, including DTS Foundation, which focuses on the incubation of blockchain startups; DTS Ventures, a venture capital firm that invests in blockchain startups; DTS Media, which engages in marketing and event organization; and Mira Blockchain Center, which focuses on the development and support of blockchain and AI technologies.

news
Policy & Regulation·

Nov 08, 2024

Japan to fine-tune crypto regulations to protect investors

Japan's Financial Services Agency (FSA) is proposing new legislation in an effort to prevent the assets of Japanese investors held on crypto exchanges from being transferred overseas. According to local news outlet Jiji Press, the Japanese regulator recently put forward the idea of drafting such a bill. It’s thought that the move suggests that the Japanese regulators have learned from the collapses of cryptocurrency exchanges Mt. Gox and FTX. Photo by Jaison Lin on UnsplashLearning from past failuresWhile Japan already had a higher standard of regulation in place prior to the FTX collapse, likely as a consequence of the authorities having experienced the downfall of Mt. Gox in February 2014, there is still room for improvement.  While funds had been ring-fenced for FTX Japan users, those who accessed services advertised in Japan through the FTX app were deemed to have been accessing a service which fell under an international jurisdiction, denying them the same protections otherwise offered to FTX Japan platform users as a consequence of the regulations that had been put in place. Incorporating a holding orderJapanese media outlet Nikkei described this latest move by the Japanese FSA as follows: “The Financial Services Agency is moving towards creating a new ‘holding order’ in the Payment Services Act, which regulates cryptocurrency exchanges, that will order them not to take domestic assets entrusted to them by customers overseas.” Consequently, the regulator is looking to add this as the latest proposed amendment to the Payment Services Act. Back in September it emerged that amendments to that existing legislation were being looked at with a view towards making it easier for businesses to incorporate digital assets into their service offerings. The regulator has also been mulling over the reclassification of crypto as a financial instrument by amending the Payment Services Act accordingly. Additionally, a more generous tax policy is being proposed. Currently, the Japanese authorities impose a tax rate of up to 55% on cryptocurrency-related revenues. Corporate holders of digital assets have to apply a 30% tax rate, irrespective of income or profits. With that, a 20% tax rate is being considered. The matter became a political issue prior to the East Asian nation’s recent elections, with the leader of the Democratic Party for the People (DPP) backing the application of a 20% crypto tax rate. The application of a holding order has applied previously to companies that have been registered under the Financial Instruments and Exchange Act. This proposed amendment would see it applied to virtual asset trading platforms as part of the Payment Services Act. Guarding against bankruptcy lossesIf applied, the amendment would prevent loss of Japanese investor funds in circumstances where a crypto exchange platform goes into bankruptcy. Legal precedent set in the FTX bankruptcy in the United States means that if a user’s funds go into a non-individually segregated hot wallet belonging to an exchange, any property rights, even if explicitly outlined in the terms of service, are lost.  A company can make a case to go into bankruptcy in any international jurisdiction, which means that this precedent has potential implications for all market participants. The proposed amendment from the Japanese FSA would serve to protect investors from such an eventuality.

news
Loading