The crew behind Balancer, an Ethereum-based automated market maker, believes a social engineering assault on its DNS service supplier was what led to its web site’s frontend being compromised on Sept. 19, resulting in an estimated $238,000 in crypto stolen.
“After investigation, it’s clear that this was a social engineering assault on EuroDNS, the area registrar used for .fi TLDs,” the agency defined in a Sept. 20 X publish.
Roughly 8 hours after the primary warning of the assault, Balancer mentioned its decentralized autonomous group (DAO) was actively addressing the DNS assault and was working to get well the Balancer UI.
At 5:45 pm UTC on Sept. 20, Balancer mentioned it was profitable in securing the area and bringing it again below the management of Balancer DAO. It additionally confirmed its subdomains “app.balancer.fi” and different “balancer.fi” are secure to make use of once more.
After investigation it’s clear that this was a social engineering assault on EuroDNS, the area registrar used for .fi TLDs.
We’re exploring deprecating the .fi TLD to be able to transfer to a safer registrar and counsel that different tasks utilizing the TLD do the identical.
[2/2]
— Balancer (@Balancer) September 20, 2023
Nonetheless, it urged every other tasks utilizing the identical top-level area ought to contemplate shifting to a safer registrar.
EuroDNS is a Luxembourg-based area title registrar and DNS service supplier. Cointelegraph has reached out to EuroDNS for remark.
Angel Drainer concerned
Blockchain safety corporations SlowMist and CertiK reported that the attacker employed Angel Drainer phishing contracts.
SlowMist mentioned the exploiters attacked the Balancer’s web site by way of Border Gateway Protocol hijacking — a course of the place hackers take management of IP addresses by corrupting web routing tables.
The hackers then induced customers to “approve” and switch funds by way of the “transferFrom” operate to the Balancer exploiter, it defined.
Associated: Breaking: ‘All funds are in danger’ — Steadefi exploited in ongoing assault
The hacker, whom SlowMist believes could also be associated to Russia, has already bridged among the stolen Ether (ETH) to Bitcoin (BTC) addresses by way of THORChain earlier than ultimately being bridging the ETH again to Ethereum, blockchain safety agency SlowMist defined on Sept. 20.
SlowMist said in an earlier publish that the hacker transferred about 15 wrapped-Ether (wETH.e) on the Avalanche blockchain.
Balancer Hack Replace
To date, we’ve the next findings concerning the @Balancer exploiter:
1/ The attacker’s payment got here from the phishing group #AngelDrainer. In different phrases, after the attacker (AngelDrainer) attacked the web site by way of BGP hijacking, then induced customers to… https://t.co/5g6P2aPEz8 pic.twitter.com/3PInfe9VC1
— MistTrack️ (@MistTrack_io) September 20, 2023
In the meantime, regardless of Balancer confirming its subdomains, balancer.fi to now be secure, visits to the web site nonetheless reveals “Misleading website forward” warning when trying to entry the Balancer’s web site.
Cointelegraph reached out to Balancer to verify the quantity of funds misplaced however didn’t obtain an instantaneous response.
Journal: $3.4B of Bitcoin in a popcorn tin: The Silk Street hacker’s story
