The Six Hundred Million Dollar Heist

With news today that cybercriminals have stolen over six hundred million dollars in digital tokens, Deep Secure’s Crypto Security Expert, Aaron Mulgrew looks at what went wrong and how best to protect crypto assets from the criminals.

Exploiting Smart Contracts Within the cryptocurrency world, there are multiple ‘blockchains’ based on multiple currencies. Perhaps unsurprisingly, various projects have been initiated to develop a single service that can overlay these multiple chains and make it easier to trade between them. One such example is Poly Network, but there are others including Cosmos[1] and Polkadot[2].

The attack is rumoured to be an exploit surrounding how the ‘smart contracts’ make up the blockchain overlay that Poly Network offers. The smart contract is in fact two separate contracts. There is a manager contract and a data contract. The data contract specifies the address which can submit transactions and withdraw coins from the pool. This is the important contract. If someone was able to modify the address to their own, they could drain all the assets from the pool because within the underlying programming language Solidity [3], it is possible to set certain functions to only run if the owner runs that smart contract.

Validation Logic

Remember that a smart contract can consist of two contracts, the manager contract, and the data contract. Well, this is where it gets interesting. Some poor validation logic means an attacker can create a payload that can match the first four bytes of the poor validation code [4], giving them access to the functions they didn’t have access to before and running as the ‘owner’ of the protocol.

In the Poly Network heist, this is what it is believed the attackers did, running a series of transactions to drain the entire pool of coins, estimated to be approximately $600m.

Wider Lessons If there is a wider lesson beyond this particular protocol exploit, it is that crypto custodians, exchanges and service providers must take extreme measures to protect the digital assets they protect. In addition to using Hardware Security Modules (HSM) these should include protocol breaks, one-way data flows and data validation performed in hardware logic to foil the attackers.

At Deep Secure we have developed a Threat Removal for Crypto Currency solution that does exactly this, delivering the very highest levels of assurance that the communication channel between untrusted network and secure enclave cannot be exploited by the criminal.

Deep Secure is actively working with banks and financial institutions to help protect their cryptocurrency infrastructure from cyberattack. If you would like to know more about how we can help you, please contact us today.