Top

Crypto vulnerability uncovered with $1B in digital asset exposure

Policy & Regulation·November 22, 2023, 3:00 AM

Security vulnerabilities in the validator infrastructure of InfStones, an established infrastructure provider, have been disclosed by Tel Aviv-headquartered cybersecurity firm dWallet Labs.

Photo by Brett Jordan on Unsplash

 

Blockchain network validator vulnerability

In a detailed Medium blog post published on Tuesday, dWallet Labs shed light on a series of vulnerabilities that, when exploited, could potentially allow attackers to gain full control, execute code and extract private keys from numerous validators on major blockchain networks. Cryptocurrencies such as ETH, BNB, SUI, APT and others were identified as at risk, with potential direct losses estimated to exceed one billion dollars.

The vulnerabilities discovered by dWallet Labs opened the door for attackers to compromise the private keys of validators across multiple blockchain networks, putting over one billion dollars of staked assets at risk. In response to the findings, InfStones, a Web3 infrastructure platform, also released a statement on Tuesday acknowledging the potential threat. However, its representative, Darko Radunovic, disputed the figures provided by dWallet Labs in a statement sent to Cointelegraph. Radunovic stated that the vulnerabilities identified in the production environment account for below 0.1% of their active nodes launched to date, emphasizing that the impact would be limited to a small fraction of their operational nodes.

According to InfStones, “237 instances were in scope, of which 212 instances were deployed for our development and testing purposes, and 25 freshly deployed instances in the production environment.”

 

Mitigating steps taken

The company detailed the immediate actions taken to mitigate the vulnerabilities, including shutting down the affected ports, as well as rotating all credentials and keys within their platform. An internal review conducted by InfStones revealed no additional adverse effects. Notwithstanding that, the company took the additional step of hiring an external security firm to audit its systems and policies.

Meanwhile, dWallet Labs Founder and CEO Omer Sadika shared his thoughts on the X platform as to how he believes such events should be handled. Sadika wrote:

”The worst way to handle a cybersecurity vulnerability is not taking responsibility and lying. We were super open and transparent with the goal of eliminating the risk to web3. My take: it’s not about whether you are fully secure or not, because no one is, it’s about how you handle it and maintain the trust with your partners and customers.”

The collaboration between dWallet Labs and InfStones sheds light on the ongoing challenges faced by the cryptocurrency industry in maintaining the security and integrity of blockchain networks. While vulnerabilities were identified and addressed, the incident underscores the importance of proactive security measures to safeguard the assets and data within the rapidly evolving landscape of digital assets.

More to Read
View All
Policy & Regulation·

Sep 16, 2023

Politician Responds as Buterin Questions Hong Kong’s Crypto Credentials

Politician Responds as Buterin Questions Hong Kong’s Crypto CredentialsIn a measured response on Friday, Johnny Ng, a member of Hong Kong’s Legislative Council, addressed the comments made by Ethereum co-founder Vitalik Buterin concerning Hong Kong’s future stance on cryptocurrencies.Photo by Florian Wehde on UnsplashInvitation extendedNg extended an invitation to Buterin to visit Hong Kong, allowing him to gain a more nuanced understanding of the region’s dynamics. Ng also expressed his intent to collaborate with relevant institutions and enterprises to provide Buterin with insights into Hong Kong’s current situation.Vitalik Buterin had voiced his concerns at the Web3 Transition Summit in Singapore on Thursday. Buterin stated:“If any crypto project wants to make Hong Kong their home, they would want to have some confidence — not just that it’s friendly now but that it will continue to be friendly years from now when all kinds of unknown, regulatory and political and other kinds of events are going to happen.”He acknowledged that he did not possess an in-depth understanding of Hong Kong’s intricacies, particularly in light of recent developments in its relationship with mainland China. Buterin emphasized the need for crypto projects to have confidence not only in Hong Kong’s current crypto-friendliness but also in its ability to maintain this stance amidst unforeseen regulatory, political, and other events.In response to Buterin’s remarks, Ng reassured him that Hong Kong’s crypto-related policies were not prone to sudden changes. He highlighted that these policies had been formulated with broad social consensus and underwent comprehensive procedural assessments. Ng asserted: “Therefore, I can tell Mr. Vitalik that Hong Kong’s policies are very stable.”He further elaborated on Hong Kong’s legislative process, emphasizing the stages of government policy drafting, public consultation, discussions within multiple committees of the Legislative Council, and the General Assembly’s review.Best-prepared crypto jurisdictionIn a separate development, Hong Kong has maintained its position as the best-prepared jurisdiction for widespread cryptocurrency adoption in 2023, according to a recently published study. The Chinese autonomous territory secured the top rank for the second consecutive year.This recognition is based on a crypto readiness score (CRS) that takes into account factors such as the presence of crypto ATMs, the regulatory environment, accessibility, and legality.In contrast, the United States slipped to third place, experiencing a 6.5% drop in its CRS score from the previous year. Switzerland emerged as the second-best-prepared jurisdiction, with its CRS score surging by over 9%.The Dutch demonstrated the highest per capita interest in crypto, while Hong Kong stood out for having the most crypto ATMs per square foot due to its smaller landmass. Within the United States, New York became the most crypto-ready state, boasting a CRS of 9.80, owing to a robust legislative environment and a thriving crypto and blockchain industry.Chainalysis crypto adoption reportMeanwhile, India emerged as the global leader in crypto adoption in 2023, according to a recently compiled Chainalysis report. The report also highlighted other lower middle-income nations, such as Nigeria and Thailand, ranking prominently in crypto adoption. India’s crypto market has surged to become the second-largest globally by raw estimated transaction volume.Johnny Ng’s response to Vitalik Buterin’s comments is indicative of the measured and informed approach of Hong Kong’s leadership regarding cryptocurrencies. With a stable and consensus-driven regulatory framework, Hong Kong remains a key player in the evolving landscape of digital currencies.

news
Web3 & Enterprise·

Dec 15, 2023

Hitachi collaborates with Concordium on biometric crypto wallet

Hitachi collaborates with Concordium on biometric crypto walletJapan’s Hitachi Solutions, a subsidiary company of the Hitachi multinational conglomerate, has joined forces with the Concordium Foundation, unveiling a collaboration that centers on a state-of-the-art biometric crypto wallet.Photo by Nuno Antunes on UnsplashAlternative approach to securing cryptoAnnounced on Tuesday by the Concordium Foundation, a Swiss-based development team behind the Concordium layer one blockchain, this “proof of technology” initiative has the potential to fundamentally change how users access and secure their cryptocurrency accounts.Breaking away from traditional methods, the proposed biometric crypto wallet leverages users’ fingerprints or facial scans to generate a set of seed words, eliminating the need for users to store or remember them. This novel approach simplifies the restoration process, allowing users to recover their accounts with a mere biometric scan.Improving UXIf crypto and Web3 are to be adopted by ordinary people en-masse, user experience has long been identified within the sector as an area that still requires development. Making users responsible for the storage of a private key is fraught with difficulty, given the likelihood of private keys being lost or compromised.Various approaches are being taken to solve this issue. Tangem Wallet is one such alternative that utilizes near-field communication (NFC) in combination with an app and a card with an inbuilt chip, negating the need for the user to memorize a private key.This biometric-centered approach from Hitachi and Concordium represents another user-friendly approach to the problem of user authentication, harnessing the power of Hitachi’s Public Biometric Infrastructure (PBI) and Concordium’s self-sovereign identity framework. The result is an account creation process based entirely on biometric data, enhancing both security and user convenience.Complementary technologyConcordium’s network, with its stringent ID process for account creation to combat malicious activities, stands to gain substantial benefits from this technology. The biometric wallet will fortify users’ access to their IDs, a critical aspect of network security. Moreover, the technology’s applicability extends beyond Concordium, offering potential integration with any blockchain network.Users of the biometric wallet will have the flexibility to unlock their accounts either by regenerating seed words through a biometric scan or by decrypting a copy of the seed words. This dual-layered approach ensures that access is granted solely through the user’s unique biometric data, enhancing security and mitigating the risk of loss or theft.Developing this cutting-edge technology poses challenges, particularly in handling the inherent “fuzziness” of biometric data, where no two scans produce identical results, even from the same individual. Hitachi’s team addressed this by employing fuzzy key generation and specialized error correction technology, effectively distinguishing between scans.Unlike traditional crypto wallets that necessitate secure storage of seed words, the biometric wallet by Hitachi and Concordium, alongside solutions like multiparty-computation wallets and magic links, aims to overcome this hurdle. The goal is to resolve the issue of lost backup, a significant barrier to wider crypto adoption.This is not Hitachi’s first foray into the crypto/blockchain space. In mid-November the company announced a collaboration with the Japan Exchange Group (JPX), banking giant Nomura and Nomura portfolio company BOOSTRY to launch a $69 million digital green bond on the blockchain. In October Hitachi joined a consortium of Japanese companies with a view towards developing decentralized identity technology.

news
Policy & Regulation·

Oct 05, 2023

KCS Says Illegal Forex Transactions for Crypto Purchases Amount to $7.7B

KCS Says Illegal Forex Transactions for Crypto Purchases Amount to $7.7BOver the past five years, the total value of illegal foreign exchange transactions associated with virtual asset purchases has amounted to approximately KRW 10.4 trillion ($7.7 billion), according to the Korea Customs Service’s report received on Thursday by Go Yong-jin, a member of the Democratic Party of Korea on the National Assembly’s Strategy and Finance Committee.Photo by Sasun Bughdaryan on Unsplash“Illegal transactions on foreign exchanges for the purchase of virtual assets are occurring due to the higher prices of virtual assets in Korea compared to prices abroad,” Go explained.Crimes incited by crypto waveThe data showed that the number of violations subject to fines was 6,066, involving forex transactions of KRW 2.3 trillion. In particular, violations made in 2020 and 2022 accounted for the majority, making up 78.7% with 4,775 cases and a value of KRW 1.9 trillion, or 83.7% of the cumulative total. This indicates a substantial increase in illegal activities during the periods when the crypto investment frenzy in Korea was at its peak.Uncovering key patternsWhile foreign exchange transactions were primarily intended for acquiring virtual assets, they were often disguised as trade payments. There were also cases where individuals withdrew foreign currency from overseas ATMs to buy cryptocurrencies. These two scenarios were the most prevalent cases for which fines were imposed. More specifically, among the 6,066 violations, there were 4,518 instances of the former and 1,486 cases of the latter. The transferred funds amounted to KRW 1.9 trillion and KRW 407 billion, respectively.During the five-year period, individuals involved in 93 cases of these forex activities — collectively valued at KRW 8.1 trillion — were penalized following the referral of their cases to prosecutors. In particular, the violations in 2022 accounted for 70.3% (KRW 5.7 trillion). This could be accredited to the breakout of suspicious large-scale forex transactions last year, which prompted local authorities such as the Korea Customs Service and the Financial Supervisory Service (FSS) to initiate planned investigations.The most common type of illegal foreign exchange transaction cases referred to prosecutors was similar to those that incurred fines: overseas remittances disguised as trade payments, constituting 49.9% (KRW 4 trillion) of all cases. Transferring foreign currency via unregistered entities was the second most common violation, making up 47.2% (KRW 3.8 trillion). These transfers breach the Foreign Exchange Transactions Act and are always reported to prosecutors.Go thereby called on authorities to intensify crackdowns on illegal forex transactions aimed at trading virtual assets and to revise foreign exchange regulations accordingly.

news
Loading