TL;DR#

On November 10, 2023, the hot wallet of Poloniex was exploited, resulting in a loss of assets worth over $123 million.

Introduction to Poloniex#

Poloniex is a cryptocurrency exchange owned by Justin Sun.

Vulnerability Assessment#

The root cause of the exploit is reportedly due to the compromise of its private keys.

The hackers are believed to have obtained the private keys through a coordinated phishing attack, social engineering tactics, or the dissemination of a malicious Trojan virus, all of which potentially contributed to the unauthorized acquisition of these critical private keys.

Steps#

Step 1:

The address of the exploiter, tagged as Poloniex Hacker 1, first transferred 4900 ETH, worth approximately $10,219,220, from the hot wallet of Poloniex and then began transferring all other assets one after another.

Step 2:

Approximately 25.5 trillion ELON tokens, worth $3,984,349, were also transferred from this hot wallet of Poloniex to this address tagged as Poloniex Hacker 1.

Step 3:

Apparently, this hot wallet tagged as Poloniex 4 was drained of over $62.62 million. Over 94% of these total assets have been swept away, with just $3,662,756 remaining in its wallet.

Step 4:

This address of the exploiter, tagged as Poloniex Hacker 4, currently holds $22,663,778 worth of multiple stolen assets.

Step 5:

The exploiter also mistakenly transferred approximately $2.5 million worth of GLM tokens to the GLM token deployer address instead of the address for the sale.

Step 6:

These stolen assets include multiple tokens worth hundreds and thousands of dollars in ETH, TRON, GLM, LINK, OX, MANA, AKITA, DYDX, stable coins such as USDT and TUSD, and meme coins including PEPE, FLOKI, and SHIB, amongst others.

Step 7:

According to investigations by Arkham, the Poloniex hacker has swept away funds worth over $123 million. Approximately $57.79 million worth of the stolen funds are held on the Ethereum Mainnet, $47.52 million on the Tron network, $18.55 million on BTC, and others.

Aftermath#

The team acknowledged the occurrence of the exploit and stated that their wallet has been disabled for maintenance.

Justin Sun also acknowledged the incident and stated that they are currently investigating the Poloniex hack incident. He also asserted that the exchange maintains a healthy financial position and would reimburse the affected funds. The team is also likely to collaborate with other exchanges to facilitate the recovery of the misappropriated funds.

Solution#

In response to the recent exploit at Poloniex, a comprehensive and multi-faceted approach is imperative to bolster security and avert similar incidents in the future. Central to these efforts is a thorough revamp of the private key management system. A key strategy includes the adoption of a multi-signature wallet system, which, by requiring multiple confirmations for transactions, significantly mitigates the risk of unauthorized access. In tandem with this, shifting away from the storage of private keys in a singular, online environment is crucial. The integration of hardware security modules (HSMs) presents a more secure storage solution, effectively diminishing the risk of key compromises.

Further enhancing this security framework is the implementation of a robust cold storage solution. Cold storage entails keeping private keys completely offline, thereby substantially reducing their vulnerability to online attacks. The combination of cold storage and a multi-signature system fortifies the security infrastructure, providing a dual layer of protection. These measures are not only vital for the secure storage and management of assets but are also fundamental in rebuilding and maintaining the trust of users in the platform's security measures.

A significant factor in the exploit appears to be the human element, particularly the susceptibility to phishing and social engineering attacks. Addressing this requires a robust employee training program focused on security awareness. The introduction of advanced monitoring and anomaly detection systems is also crucial. These systems should be equipped to promptly detect unusual activities, such as atypical transaction patterns, which could signal a potential breach.

Moreover, collaboration with other cryptocurrency exchanges and specialized blockchain forensic teams can play a vital role, especially in the aftermath of security breaches. Establishing pre-defined protocols for asset recovery with these entities can speed up the process of tracking and potentially reclaiming stolen assets. Such collaborative efforts can also aid in blacklisting hacker-associated addresses, thereby hindering the movement of stolen assets across different platforms. Regular external security audits and penetration tests are another key component. These should be thorough, encompassing both technical and human factors, to uncover any potential vulnerabilities. Swift action to rectify identified issues following these audits is essential to bolstering the exchange's defenses.

In the wake of the security breach at Poloniex, it's clear that while implementing preventive measures is essential, the possibility of unforeseen vulnerabilities is an ever-present concern. This is where our role at Neptune Mutual becomes crucial. We understand that partnerships with service providers and marketplaces like ours are invaluable in mitigating such risks. By creating a dedicated cover pool with Neptune Mutual before any incident, exchanges can offer their users a financial safety net against vulnerabilities in smart contracts. While typically we don’t provide coverage for exploits arising from compromised private keys, we are flexible and often make exceptions in various cases.

At Neptune Mutual, our approach in these scenarios is to ease the burden on users to prove their losses. Once an incident is confirmed and effectively resolved within our incident management system, our priority shifts to the expeditious disbursement of claims, ensuring swift financial restitution for those impacted. This process significantly simplifies the recovery for users, providing them with much-needed support in the aftermath of such incidents.

Operating across multiple blockchain networks, including Ethereum, Arbitrum, and the BNB chain, we remain steadfast in our commitment to user safety. This commitment is fundamental to the trust we build within the DeFi community. Especially in light of incidents like the one at Poloniex, our presence offers reassurance amidst the myriad security challenges in the digital finance landscape. At Neptune Mutual, we are dedicated to maintaining this trust and providing a secure, reliable service to our community.

Reference Source Hacken