Top

Crypto vulnerability uncovered with $1B in digital asset exposure

Policy & Regulation·November 22, 2023, 3:00 AM

Security vulnerabilities in the validator infrastructure of InfStones, an established infrastructure provider, have been disclosed by Tel Aviv-headquartered cybersecurity firm dWallet Labs.

Photo by Brett Jordan on Unsplash

 

Blockchain network validator vulnerability

In a detailed Medium blog post published on Tuesday, dWallet Labs shed light on a series of vulnerabilities that, when exploited, could potentially allow attackers to gain full control, execute code and extract private keys from numerous validators on major blockchain networks. Cryptocurrencies such as ETH, BNB, SUI, APT and others were identified as at risk, with potential direct losses estimated to exceed one billion dollars.

The vulnerabilities discovered by dWallet Labs opened the door for attackers to compromise the private keys of validators across multiple blockchain networks, putting over one billion dollars of staked assets at risk. In response to the findings, InfStones, a Web3 infrastructure platform, also released a statement on Tuesday acknowledging the potential threat. However, its representative, Darko Radunovic, disputed the figures provided by dWallet Labs in a statement sent to Cointelegraph. Radunovic stated that the vulnerabilities identified in the production environment account for below 0.1% of their active nodes launched to date, emphasizing that the impact would be limited to a small fraction of their operational nodes.

According to InfStones, “237 instances were in scope, of which 212 instances were deployed for our development and testing purposes, and 25 freshly deployed instances in the production environment.”

 

Mitigating steps taken

The company detailed the immediate actions taken to mitigate the vulnerabilities, including shutting down the affected ports, as well as rotating all credentials and keys within their platform. An internal review conducted by InfStones revealed no additional adverse effects. Notwithstanding that, the company took the additional step of hiring an external security firm to audit its systems and policies.

Meanwhile, dWallet Labs Founder and CEO Omer Sadika shared his thoughts on the X platform as to how he believes such events should be handled. Sadika wrote:

”The worst way to handle a cybersecurity vulnerability is not taking responsibility and lying. We were super open and transparent with the goal of eliminating the risk to web3. My take: it’s not about whether you are fully secure or not, because no one is, it’s about how you handle it and maintain the trust with your partners and customers.”

The collaboration between dWallet Labs and InfStones sheds light on the ongoing challenges faced by the cryptocurrency industry in maintaining the security and integrity of blockchain networks. While vulnerabilities were identified and addressed, the incident underscores the importance of proactive security measures to safeguard the assets and data within the rapidly evolving landscape of digital assets.

More to Read
View All
Policy & Regulation·

Oct 20, 2023

US Treasury Sanctions Gaza-Based Crypto Operator

US Treasury Sanctions Gaza-Based Crypto OperatorThe Office of Foreign Assets Control (OFAC) of the United States Department of the Treasury has imposed sanctions on a crypto operator allegedly linked to the Palestinian militant group Hamas.The move by OFAC comes as a result of greater scrutiny of terrorist financing following an attack by Hamas on Israel in early October, in which a number of Israelis lost their lives.Photo by Karolina Grabowska on Pexels“Buy Cash Money and Money Transfer Company”The entity targeted by these sanctions is a Gaza-based virtual currency exchange known as the “Buy Cash Money and Money Transfer Company.” It is operated by Khan Yunis, a resident of Gaza. According to the Treasury Department, both the exchange and Khan Yunis are alleged to have ties to Hamas. Ahmed M.M. Alaqad, the owner of the business, has also been named in the sanctions.The primary objective of these sanctions, as stated by the Treasury Department, is to disrupt the sources of revenue for Hamas. The attack on Israel served as a trigger for these actions. Treasury Secretary Janet Yellen emphasized the determination to prevent Hamas from raising funds for further acts of terror and violence against the people of Israel.This includes imposing sanctions and cooperating with international allies and partners to identify, freeze, and seize any assets related to Hamas in their respective jurisdictions. Yellen stated:“The United States is taking swift and decisive action to target Hamas’s financiers and facilitators following its brutal and unconscionable massacre of Israeli civilians, including children.”Crypto sector riskIt’s not the first time that crypto platforms have been implicated where terrorist financing is concerned. Earlier this year it emerged that Bitfinex Turkiye, the Turkish local exchange business of global crypto platform Bitfinex, was alleged to have been used for the purposes of money laundering by Hamas. Additionally, leading crypto platform Binance has found itself facing similar allegations.In the immediate aftermath of the recent attack, Israeli authorities moved to close down accounts they claimed were linked with Hamas on crypto platforms like Binance and elsewhere. The Israelis have continued where they left off in this respect, with a report emerging earlier this week that over one hundred accounts on Binance have been ordered to be shut down, with a further two hundred accounts facing scrutiny.While crypto may not account for a sizable proportion of terrorist financing means, these events open up a point of attack for those who oppose the further roll-out of decentralized money and systems.Fighting illicit finance through sanctionsNotably, the US Treasury has been employing sanctions as a tool to cut off financial support to entities suspected of being involved in terrorism or other illicit activities. In a similar vein, earlier in October, the Treasury announced sanctions against crypto wallets associated with Chinese chemical manufacturers, concurrently with an indictment from the Department of Justice related to the production of the drug fentanyl.Earlier this year, blockchain analytics firm Elliptic indicated that most Chinese suppliers of fentanyl precursors were accepting payments for the illicit material in cryptocurrency.It’s worth mentioning that this move by OFAC not only targets Hamas but also includes other entities allegedly connected to the Buy Cash Money and Money Transfer Company, including an al-Qaeda affiliate and the Islamic State of Iraq and Syria (ISIS).

news
Policy & Regulation·

Feb 02, 2024

Hong Kong’s PCPD investigates Worldcoin over privacy concerns

On Wednesday, the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong launched investigations at six premises controlled by Worldcoin, the biometric cryptocurrency project established by Sam Altman, the CEO of OpenAI. Potential personal data privacy risksIn a statement, the Privacy Commissioner expressed serious concerns about potential risks to personal data privacy. The PCPD executed warrants as part of the inquiry into Worldcoin's identity verification project, particularly focusing on the use of iris-scanning orbs for identity verification. The PCPD urged Hong Kong residents to consider the implications of Worldcoin's biometric data collection and emphasized the importance of evaluating the legitimacy of such data collection. The Commission also advised individuals to inquire about the purpose of data collection, the intended use of the data, the classes of entities with access to the data, the retention period of biometric data and the safety measures implemented to protect sensitive information. "The PCPD is concerned that the operation of Worldcoin in Hong Kong involves serious risks to personal data privacy, and believes that the collection and processing of sensitive personal data by the relevant organization may be in contravention of the requirements of the Personal Data (Privacy) Ordinance," stated the privacy watchdog. The Commission highlighted that any personal data controlled by Worldcoin must be collected for a lawful purpose related to the project's function or activity, with the information collected from users' irises deemed sensitive according to regulatory guidelines.Photo by Harpreet Singh on UnsplashGlobal scrutinyWorldcoin, which commenced operations in 2021 and officially launched in July 2023, has faced regulatory scrutiny in various countries due to privacy concerns. As of December 2023, Worldcoin reported that over 5 million people had created accounts using their identities. However, the project's approach to identity verification through iris scanning has triggered investigations and actions by regulators. Notably, the project suspended services in Kenya and halted iris scans in India in response to regulatory challenges.  The company’s activities in the French and Brazilian markets have been suspended. Last year the UK’s Information Commissioner’s Office said that it would make further enquiries into the company’s activities. Meanwhile, the German data watchdog has been investigating Worldcoin since 2022. In an effort to clarify the efforts the company is making to achieve compliance across international jurisdictions where data privacy is concerned, Worldcoin recently published a blog post on the subject. Within it, the company states that it “is designed to be fully compliant with all laws and regulations governing data collection and data transfer." Despite its ongoing regulatory challenges, Worldcoin CEO Alex Blania remains steadfast in advancing the project's mission, stating recently:"We race toward billions of users as fast as we possibly can."  The project closed out 2023 by expanding into Singapore. The privacy concerns surrounding Worldcoin underscore the growing importance of balancing technological innovation with robust data privacy regulations to ensure the protection of individuals' sensitive information.

news
Policy & Regulation·

Nov 07, 2024

Crypto community optimism across Asia following Trump’s election victory

Recognition of Donald Trump’s victory in the U.S. presidential election on Nov. 6 has led to many crypto proponents in Asia foreseeing a positive outcome for crypto within the Asian region, and globally.Photo by Kevin Lanceplaine on UnsplashBright future for cryptoAccording to a report published by the South China Morning Post (SCMP), crypto proponents in China are expectant of a bright future for crypto both on the Chinese mainland and in Hong Kong. The mindset seems to be that a pro-crypto stance in the U.S. will lead to other jurisdictions taking a similar approach. HashKey CEO Livio Weng expressed such a view, stating:“Trump’s pro-crypto stance is expected not only to invigorate the US virtual-asset industry, but also to encourage Hong Kong to further relax its own virtual-asset policies in its quest to become a global Web3 hub.”  Prior to being elected, Trump had promised to fire Gary Gensler, who as Chair of the Securities and Exchange Commission (SEC) has pursued a strategy of regulation by enforcement, a course of action that has been broadly criticized by crypto market participants in the United States. Ripple CEO Brad Garlinghouse wasted no time in calling on Trump to act, and to fire Gensler. Influencing regulatory attitudesThere seems to be a consensus among commentators that the regulatory approach to crypto in the U.S. is going to become crypto-friendly. Crypto analyst Miles Deutscher suggests that “a Trump victory is a WIN for US tech innovation, as it would solidify [the United States’] status as a crypto powerhouse.” Weng believes that “this shift could also positively influence regulatory attitudes toward virtual assets in mainland China.” That view is mirrored in South Korea by KP Jang, head of Xangle Research. Jang asserts that “if Trump implements bold virtual asset policies while improving existing regulations, it is expected to accelerate regulatory reforms in Korea as well.” Sumit Gupta, CEO and co-founder of India’s largest crypto exchange, CoinDCX, outlined on X that Trump’s victory is a pivotal moment for global crypto, adding:”The direct effects of Trump’s policies might not alter India’s regulatory environment right away. However, global sentiment and investor behaviour will be influenced, eventually reaching India.” The CoinDCX CEO believes that should Trump now appoint regulatory leadership that’s crypto-positive, any resultant crypto regulatory framework adopted by the U.S. could become a blueprint for use by other nations. Gupta identified further potential upside insofar as the implementation of positive crypto policies by Trump would lead to a more attractive environment for crypto, “potentially opening up enhanced funding opportunities and partnerships for Indian startups as investors seek global growth.” Bitcoin price surgeAt the time of writing, the Bitcoin unit price is up 0.64% over the course of the past 24 hours, at $74,884. American business news channel CNBC reported that Bitcoin could reach $100,000 before Trump even takes office.  Matthew Hougan, chief investment officer (CIO) at crypto asset fund manager Bitwise, said that Trump’s election victory could herald in a “golden age of crypto,” with a friendlier regulatory environment leading to greater institutional investment and mainstream adoption.

news
Loading