JetTalks

LayerZero — page 4

Platform · 69 articles
Share

Coverage, page 4

page 4 of 4

Crypto industry reels as April sees highest number of hacks ever

April was a bad time for the crypto industry. Over the past month, 29 crypto projects have suffered hacks or exploits, the highest monthly tally in the industry’s history, per DefiLlama data. Among them were two standouts: The hacks of Solana-based exchange Drift, and Ethereum-based restaking app Kelp DAO, which resulted in a combined $579 million loss. The situation has sparked a crisis of confidence among the industry’s most ardent believers and left them questioning whether the tradeoffs inherent in decentralised technology are worth the trouble. In recent years, the number of crypto hacks — and the amounts stolen — have edged higher. The fast-moving and experimental DeFi space, once notorious for exploits, was thought to have matured. But now it’s back in the limelight — and not for the right reasons. “Right now, DeFi seems to be the primary target,” Michael Pearl, vice president of strategy at crypto security firm Cyvers, previously told DL News . “In general, everything has shifted now to hacking humans rather than hacking systems.” Single points of failure The problem, according to Michael Egorov, founder of DeFi protocols Curve Finance and Yield Basis, is centralisation. “We need to reduce the number of single points of failure as much as possible,” Egorov said in a statement shared with DL News . “The goal of DeFi design should be to minimise human-centric points of failure, not add to them.” The attacks on Drift and Kelp DAO both ultimately came down to centralised weak points. North Korean hackers compromised two Drift employees through an elaborate social engineering campaign. This gave the hackers the power to make admin changes to the protocol, allowing them to steal some $285 million from users. As for Kelp DAO, the instance of the LayerZero crypto bridge the protocol relied on was configured to only require a single operator, which hackers exploited to steal $273 million. Yet centralisation is not the only way DeFi protocols are getting caught out. Last month, 24 out of the 29 incidents — almost 83% — were caused by code bugs. Crypto security experts previously told DL News that advances in artificial intelligence are making it cheaper, easier, and faster for hackers to attack DeFi protocols. Bad actors are now using the large language models that power AI chatbots like ChatGPT and Claude to search through thousands of lines of code a second. Before, they had to do so manually. Despite code bugs being the root cause of the majority of hacks, they only accounted for $42 million of April’s $635 million in losses — around 6.6%. Not the biggest loss Despite a record 29 hacks, April wasn’t the worst month by the amount of funds lost. In December 2020, hackers reportedly stole some $3.5 billion. Yet this month is often considered an outlier because the vast majority of that figure came from the hack of wallets belonging to LuBian, a Bitcoin mining company. Neither LuBian nor the suspected hacker have ever publicly acknowledged the breach, and it remained unnoticed for almost five years. Arkham Intelligence, the blockchain data platform that discovered the hack, said it was likely due to LuBian's use of a flawed private key generation algorithm that left it susceptible to brute-force attacks. The next biggest loss came in February last year when North Korean hackers swiped $1.5 billion from crypto exchange Bybit. Additionally, hackers also stole slightly more than in April in August 2021, March 2022 and October 2022 respectively. Tim Craig is DL News’ Edinburgh-based DeFi Correspondent. Reach out with tips at tim@dlnews.com .

DLNewsDLNews•Tim Craig1 May

Aave-led 'DeFi United' campaign raises $300m to address Kelp DAO breach

A version of this story appeared in The Decentralised newsletter on April 28. Sign up here. There’s been a silver lining to this month’s devastating Kelp DAO/LayerZero hack: DeFi United, an impromptu, crowdsourced recovery fund. The fund, orchestrated by Aave, has tentatively raised more than $302 million to date, much of it from DAOs and crypto businesses within the blast radius of the hack. That’s enough to fully cover the April 18 exploit, in which hackers affiliated with North Korea stole some $293 million in rsETH from Kelp DAO by targeting its faulty implementation of a LayerZero-provided bridge — technology that lets Kelp move assets between different blockchains. The hackers deposited $200 million of the stolen assets as collateral on Aave and borrowed large amounts of Ether. This left Aave with at least $177 million in unrecoverable bad debt. Aave wasn’t hacked, but it may have been the prime victim. Its deposit base fell by nearly 50% as spooked investors withdrew their crypto. Aave Labs CEO Stani Kulechov said he would contribute 5,000 Ether worth about $11 million to the DeFi United fund. Other Aave contributors have also pledged money to the effort. Arbitrum DAO, Mantle, and Consensys have pledged at least 30,000 Ether apiece. Ether.Fi and Lido DAO have pledged 5,000 and 2,500, respectively. Kelp DAO and LayerZero have also said they would pitch in. More surprising, however, is the fact that businesses and people largely unaffected by the hack have also jumped in to help. Though they haven’t contributed to the fund, the Solana Foundation and Tron founder Justin Sun both plan on depositing stablecoins in Aave, a move that can help stabilize lending markets there. Both name-checked DeFi United when announcing the moves. Count crypto VC Haseeb Qureshi among those heartened by DeFi’s kumbaya moment. “I might have to take back everything I said criticizing Ethereum rainbows and unicorns,” he said , referring to the vaguely utopian and communal ethos among many prominent Ethereum developers. “Sometimes rainbows and unicorns are exactly what a community needs. Very surprised this all came together through donations.” But it hasn’t been without controversy. Michael Bentley, the former CEO of Aave competitor Euler Labs, called it “good marketing.” “'DeFi United’ has a much nicer ring to it than ‘bailout,’” he wrote on X. The effort has even been controversial in the Aave governance forum. TokenLogic, an Aave DAO service provider, proposed contributing 25,000 Ether — worth $57 million on Tuesday — from the cooperative’s treasury. But some members had concerns. Tokédex founder Robby Greenfield noted that it asks much of the DAO “without requiring, as a precondition, any systemic reform to prevent the exact same failure from recurring.” Other members had similar qualms . Still, TokenLogic advanced the proposal to the voting stage, arguing that changes to Aave’s risk management practices were a separate, parallel conversation. “Conditioning disbursement on deliverables in a separate workstream would introduce delays and ambiguity at a moment that requires broader, industry-wide, aligned action,” it wrote on the forum. Voting began today. The hack caused a crisis of confidence in crypto. The recovery effort provided a much-needed boost of morale. Now, we have to wait and see whether the whole fiasco will lead to the kind of reform that can turn this niche corner of world finance into a mainstream product. Top DeFi stories of the week This week in DeFi governance VOTE: Lido DAO votes to contribute 2,500 Ether to DeFi United Recovery fund VOTE: Aave DAO votes to contribute 25,000 Ether to DeFi United VOTE: Aave DAO votes to formalise buyback pause Aleks Gilbert is DL News’ New York-based DeFi correspondent. You can reach him at aleks@dlnews.com .

DLNewsDLNews•Aleks Gilbert28 Apr