Will Upbit's $ 50 million loss bring Defi's "prosperity"?

The South Korean exchange was stolen again.

Following the theft of a South Korean exchange at the beginning of the year, another major South Korean exchange was "shot" again. According to the announcement just released by Upbit, it lost nearly $ 50 million.

At noon today, Whale Alert, an account that monitors large transfers on Twitter, continuously sent multiple tweets, showing that Upbit Exchange is continuously making large transfers to unknown wallets and Bittrex exchanges.

• Tucao Series | Blockchain Games on Steam
• Twitter staged "year-end drama", Ethereum founder Vitalik Buterin became industry leader
• How the Macro Economy Affects Bitcoin Price

According to data displayed by Whale Alert tweets, BlockBeats counted, including 342,000 ETH, 1.1 billion TRX, 8.63 million EOS, and 8.72 million XLM and other currencies were converted within a few hours Go, the total amount is more than 100 million US dollars.

Large transfers are not uncommon, but it is not unusual for an exchange to make large external transfers continuously. Naver, a well-known Korean portal site, is aware of this change. In a short period of time, several transfers totaling more than 100 million US dollars, Naver began to suspect that Upbit was stolen.

The news quickly fermented, and rumors of Upbit being stolen gradually began to rise, but many people held different views on this, thinking that it was just an ordinary internal exchange transfer. Because public information shows that Upbit is a cryptocurrency exchange launched by the financial technology company Dunamu in cooperation with the American exchange Bittrex. In other words, Bittrex is behind Upbit. These large transfers included transfers from Upbit to Bittrex, so they didn't think Upbit was stolen.

However, in the evening, the Upbit Exchange issued an announcement admitting that its Ethereum hot wallet lost 342,000 ETH and the loss amount was 49.8 million USD. When they discovered that they might be stolen, they quickly transferred other assets in the hot wallet to the cold wallet, and a number of large transfers occurred in succession.

Although this may be the first asset loss in the history of the Upbit exchange, this is by no means the first theft in the history of the exchange. It is more certain that this event will not be the last asset in the history of the exchange. Stolen.

What thefts happened in 2019

With the rapid development of the cryptocurrency industry in recent years, security has always been an enduring topic in the industry. Of all the stolen subjects, the trading platform is the most severely stolen area. "Working".

According to incomplete statistics, since this year, hackers have taken away hundreds of millions of dollars worth of tokens from many exchanges. Even the exchanges that claim to be equipped with top security systems have not been spared. These frequent security incidents, Constantly challenge traders' fragile nerves.

Exchanges including Bitrue, Longnet, Bitpoint, QuickBit, etc. have become the targets of hacking, or have become hackers' "ATMs", or the user's private information has been leaked. These platforms have also been criticized by users. .

In March this year, the exchange of DragonEx's wallet was hacked, resulting in the theft of digital assets of users and the platform. After the incident, the platform suspended all basic services such as transaction deposit and withdrawal. Subsequently, Longwang reported to several national judicial authorities for record filing and investigation, and the Exchange promised to take responsibility for the loss.

In the early morning of June 27, the hacker used the loophole in the second risk review process of the platform's risk control team to enter the hot wallet of Bitrue users, resulting in the theft of approximately $ 4.3 million in XRP and ADA. Regarding the loss of these funds, the exchange said 100% will be returned to the user. In July, Bitpoint (BPJ), a licensed cryptocurrency exchange in Japan, was hacked and estimated to lose about 3.5 billion yen (about 32 million U.S. dollars), and then BitPoint announced that it found 2.3 million of them.

Not only was the funds stolen, but the private information stored by users on the platform was also leaked. At the end of July this year, the Swedish cryptocurrency exchange QuickBit issued a statement saying that due to a database problem, some users' sensitive data was leaked, including private information such as names, addresses, email addresses, and credit cards.

In addition to the exchange, the project side has also been followed by hackers. On September 26 this year, hackers obtained backup data of some recovery seeds stored in encrypted files of offline devices, which led to the theft of several wallets managed by Pablo Yabo, the chief technology officer of Algo Capital GP LLC (“Algo Capital”), resulting in the theft Crypto assets worth $ 1.5 million to $ 1.9 million were lost. However, subsequently Algo Capital's managing partner promised to repay the affected funds.

Not to mention EOS, a network called a "hacker's cash machine", until this year, hackers can still transfer stolen money in the block nodes that have not been blacklisted. DApps on EOS are still hacked, even by the project party The CPU will be occupied by hackers to fleece.

If the time dimension is lengthened, there will be more similar events. According to the "2018 Annual Blockchain Security Report" released by BlockBeats at the beginning of this year, there were a total of 138 blockchain security incidents last year, a surge of 820% over the previous year, causing economic losses of up to $ 2.238 billion. After entering 2019, the number of blockchain security incidents has continued unabated, and six security incidents occurred in the first two weeks of January alone.

Where can this money go

The normal operation of a hacker is to sell coins and sell these stolen coins to other exchanges for cash. Of course, this is not particularly simple. In order to get rid of tracking, hackers need to spread 340,000 ETH to different addresses, transfer to different exchanges, and sell in batches.

But now, because the stolen coin is Ethereum, and the prosperity of the ecology on Ethereum, hackers have a new choice-DeFi. This is not without precedent.

In January this year, the hacker attacked Cryptopia, a New Zealand virtual currency exchange, and stole 30,790 ETH. The hacker was not anxious to cash, but put a part of ETH into the Ethereum decentralized financial platform Compound.

There are many decentralized financial platforms similar to Compound on Ethereum. Users can borrow, mortgage, and generate interest on the platform. Hackers depositing ETH on Compound has two "benefits": one is that they can manage money and the platform can provide storage interest; the other is that they can confuse money laundering. When a user withdraws money, it is not necessarily the ETH that he stores. Like banks, banks put users' deposits together, and they cannot trace the source when withdrawing money.

This time Upbit is the same. Hackers can also emulate his "predecessors" and put the stolen money in DeFi applications, such as MakerDAO, or Compound.

MakerDAO's feature is to generate stable currency DAI with ETH mortgage. DAI can manage money and earn interest on the platform. Hackers can use Defi to manage money or return DAI to exchange for ETH, which increases the difficulty of tracking. In Compound, hackers can deposit ETH to manage money or confuse money laundering.

Upbit's stolen money is still in the wallet, and the hacker's next move cannot be guessed. On the evening of November 27, Binance announced that if it was found that the stolen ETH had been transferred to Binance and immediately blocked the address, other exchanges were bound to have the same operation. In previous multiple coin theft incidents, multiple exchanges have also launched blacklist operations to prevent hacking assets from flowing into or laundering.

As cryptocurrency becomes a new choice for investors, the entire market is also developing rapidly. As the market expands, hacking techniques are constantly evolving, and the means of attack are becoming more and more complicated. Every time a hacking event occurs, the security problem is always Will be mentioned again. For the cryptocurrency industry, the battle between this platform and hackers will continue.

The DeFi platform, which is intended to realize decentralized lending and financial services for users, has also been given a new mission by hackers. Someone once said that the biggest application of Bitcoin is the transfer of stolen money, so when Defi has also become a channel for hackers to transfer property, is this good or bad for Defi?

(Block Beats reminds that according to the document issued by the Banking Regulatory Commission and other five departments in August 2018 on "Precautions against Risks of Illegal Fundraising in the Name of" Virtual Currency "" Blockchain " Chain, do n’t blindly believe in the promise of smallpox, establish the correct currency concept and investment concept, and effectively raise the risk awareness; you can actively report to the relevant departments about the illegal and criminal clues.)

We will continue to update Blocking; if you have any questions or suggestions, please contact us!