TL;DR#

On October 17, 2023, the hot wallet assets of Fantom Foundation were drained due to reportedly a zero-day vulnerability on Google Chrome, which resulted in an overall loss of 4,501.48 ETH across multiple wallets, worth approximately $7 million.

Introduction to Fantom#

Fantom is a fast and scalable Layer-1 platform built on an aBFT consensus protocol.

Vulnerability Assessment#

The primary cause of the vulnerability appears to stem from a compromise of private keys.

This breach is thought to have originated from a sophisticated strategy that may have involved coordinated phishing attacks, social engineering tactics, or the dissemination of malicious Trojan software, all of which potentially contributed to the unauthorized acquisition of these critical private keys from the exployees of the Foundation by the perpetrators.

Attack Explained#

The addresses of the attacker are tagged as Fake_Phishing188024 and Fake_Phishing188025, and they have drained all the assets of the Foundation from their Ethereum, BNB chain, and Fantom hot wallets.

The foundation wallets with labels Wallet 1, Wallet 16, Wallet 19, and Wallet 20 were drained on the Fantom chain.

Additionally, Fantom: Foundation wallets labeled Wallet 1, Wallet 15, and Wallet 18 were compromised on the Ethereum Mainnet.

The total profit for the attacker is approximately $7 million. Apparently, a team member from the foundation lost nearly $3.4 million worth of his assets.

The total list of the affected wallets and other victims of the attacks is shared here.

At the time of writing, the attacker has consolidated all of the stolen funds worth $7,078,184 at this EOA address.

Aftermath#

The team acknowledged the occurrence of the incident and stated that the exploit only targed a small number of Fantom wallets. They reassured that the wallets in reference to the Fantom Foundation only lost approximately $550,000, and a significant majority of the Fantom Foundation funds were unaffected and remain secure.

They are also investigating the actual cause of the attack, and the funds lost by the employee are currently being tracked and investigated.

The attack caused a decrease in TVL of FTM by over 19%. 

Solution#

In addressing the recent exploit of the Fantom Foundation's assets, it's crucial to first dispel the initial assumption that a zero-day vulnerability in Google Chrome was the root cause. Historical data shows that the last such exploit dates back to September 23, 2023, making it highly implausible that an out-of-date browser version was the culprit this time around. Instead, our analysis suggests a more probable cause: the compromise of private keys, likely exacerbated by targeted phishing attacks exploiting users' lack of cybersecurity awareness.

Preventing exploits labeled as 'Google Zero-Day' or similar requires a robust, multi-faceted cybersecurity strategy. Organizations must foster a culture of security mindfulness, ensuring that team members understand threats and are vigilant against suspicious communications or requests for sensitive information. Regular updates and patches to all software are a non-negotiable standard, along with the deployment of advanced endpoint security solutions that offer real-time monitoring and protection against unpatched vulnerabilities. Simultaneously, leveraging threat intelligence services helps in proactively identifying potential zero-day vulnerabilities and taking preemptive measures before an exploit occurs.

The compromise of a private key can cause a catastrophic downfall for a DeFi protocol or individuals as a whole. Such compromises often occur through cunning social engineering tactics, malware, or even direct theft of data from insecure storage points. Preventing this necessitates stringent security measures, starting with comprehensive cybersecurity training to heighten users' awareness of phishing schemes and other social engineering tactics. Moreover, the implementation of hardware security modules for key management can provide an added layer of security, making it exceedingly difficult for unauthorized users to access these sensitive keys.

Surprisingly, despite the known risks, many teams still store substantial assets in hot wallets, which are always connected to the internet and thus more susceptible to attacks. A shift toward cold storage solutions, or at least a partial move to hold a significant portion of assets in hardware or paper wallets, could dramatically reduce the risk of theft. These offline storage methods ensure private keys are kept away from internet-connected devices, drastically lowering the potential for unauthorized access.

Even the most rigorous security measures cannot completely preclude the possibility of hacks and exploits. This inherent unpredictability of digital assets underscores the criticality of safeguards like those provided by Neptune Mutual. If the Fantom Foundation had engaged in a partnership with us to create a dedicated cover pool, the fallout from this breach could have been markedly mitigated. These cover policies function as a financial cushion, offering users a means to soften the financial impact deriving from unforeseen vulnerabilities in smart contracts. While our policies typically exclude coverage for incidents stemming from private key compromises, we maintain flexibility and are often willing to consider exceptions.

With Neptune Mutual, users are relieved of the burden of producing extensive evidence of their losses. As soon as an incident is confirmed and resolved via our incident resolution mechanism, we prioritize quick compensation disbursement, providing prompt support to the affected individuals.

Functioning across multiple blockchain networks, such as Ethereum, Arbitrum, and the BNB chain, we are committed to broadening its protective embrace to encompass a wide variety of participants in the DeFi space.

Reference Source Hacken