Study: 88% of hackers were ‘copycats’ when hacking Nomad Bridge

According to data provided by analysts at the Coinbase exchange, during a large-scale hacking of the DeFi Nomad project’s gateway bridge, 88% of hackers turned out to be simple “copycats”.

Recall that in early August, hackers withdrew assets worth $190 million from the Nomad bridge. The hack was called “the most chaotic in the DeFi industry.” The fact is that when updating the smart contract, the developers made a mistake due to which the smart contract automatically confirmed transactions.

Any user could copy an already completed transaction, change the recipient’s address in it to their own, send it to a smart contract and receive tokens to their wallet.

88% of the withdrawal addresses used the same transaction, according to Coinbase’s principal investigator for blockchain threats Peter Kacherginsky and Senior Special Investigations Officer Heidi Wilder.

110822_nomad_hack_unique_addr.jpg

Initially, two hackers discovered the vulnerability and took advantage of it, and then a lot of “copycats” copied the method and transferred tokens to their wallets. At the same time, it was the first two hackers who withdrew a significant part of the funds in wBTC, USDC and wETH tokens.

Recall that the developers of the Nomad project announced a 10% reward for a refund. And many attackers took advantage of the opportunity to become a “white hacker” – as of August 6, about 12% of the stolen funds were returned to the project, and at the moment the figure has grown to 17%.

Source: Bits

You may also like