{"id":172260,"date":"2024-09-26T16:54:01","date_gmt":"2024-09-26T16:54:01","guid":{"rendered":"https:\/\/crypto-economy.com\/?p=172260"},"modified":"2024-09-26T16:54:41","modified_gmt":"2024-09-26T16:54:41","slug":"onyx-protocol-loses-3-8m-in-another-defi-hack-funds-already-swapped","status":"publish","type":"post","link":"https:\/\/crypto-economy.com\/onyx-protocol-loses-3-8m-in-another-defi-hack-funds-already-swapped\/","title":{"rendered":"Onyx Protocol Loses $3.8M in Another DeFi Hack\u2014Funds Already Swapped"},"content":{"rendered":"<p style=\"text-align: justify\">TL;DR<\/p>\n<ul>\n<li style=\"text-align: justify\"><strong>Onyx Protocol<\/strong>, a fork of Compound Finance, suffered a <strong>cyber attack<\/strong> that resulted in a loss of <strong>$3.8 million<\/strong>.<\/li>\n<li style=\"text-align: justify\">The attackers exploited<strong> a known precision issue in the protocol&#8217;s code<\/strong>, which allowed for the swapping of stolen funds.<\/li>\n<li style=\"text-align: justify\">This is not the first attack on the protocol, as <strong>$2.1 million had already been lost<\/strong> in October 2023 <strong>due to a rounding error<\/strong>.<br \/>\n<hr \/>\n<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>Onyx Protocol<\/strong>, a fork of Compound Finance, <strong>has been the victim of a cyber <a href=\"https:\/\/crypto-economy.com\/dns-attacks-and-cryptocurrencies-how-to-protect-ourselves\/\" target=\"_blank\" rel=\"noopener\">attack<\/a> that resulted in the loss of $3.8 million<\/strong>, adding to the list of vulnerable DeFi platforms.<!--more--><\/p>\n<p style=\"text-align: justify\">The incident occurred after the <strong>attackers exploited a known precision issue in the protocol&#8217;s code<\/strong>, which had already been exploited in other similar forks. According to reports from the security firm PeckShield, a series of <strong>suspicious transactions<\/strong> in OnyxDAO led to the detection of the attack, allowing hackers to <strong>perform swaps of the stolen funds<\/strong>.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Hi <a href=\"https:\/\/twitter.com\/OnyxDAO?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@OnyxDAO<\/a>, you may want to take a look <a href=\"https:\/\/t.co\/fcU6fHP4jr\" target=\"_blank\">pic.twitter.com\/fcU6fHP4jr<\/a><\/p>\n<p>&mdash; PeckShield Inc. (@peckshield) <a href=\"https:\/\/twitter.com\/peckshield\/status\/1839296480357789902?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">September 26, 2024<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p style=\"text-align: justify\">Most of the losses were recorded in <strong>VUSD<\/strong>, although the attackers also stole assets such as <strong>XCN, DAI, WBTC, and USDT<\/strong>. A subsequent analysis by the security firm Cyvers corroborated the loss amount, which stood at <strong>approximately $3.2 million<\/strong> at the time of the attack. Apparently, the hacker held a balance of <strong>521 ETH<\/strong>, equivalent to <strong>$1.36 million<\/strong>, while other digital assets had not yet been swapped.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8ALERT\ud83d\udea8Our system has detected suspicious transaction involving <a href=\"https:\/\/twitter.com\/OnyxDAO?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@OnyxDAO<\/a> on <a href=\"https:\/\/twitter.com\/hashtag\/ETH?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">#ETH<\/a> chain!<\/p>\n<p>Total loss is around  $3.2M. Most of the loss are in <a href=\"https:\/\/twitter.com\/search?q=%24VUSD&amp;src=ctag&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">$VUSD<\/a>. Attacker currently holds 521 <a href=\"https:\/\/twitter.com\/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">$ETH<\/a> $1.36M. Rest of the digital assets are not swapped yet!<\/p>\n<p>More info will follow! Stay tuned!\u2026 <a href=\"https:\/\/t.co\/CwGwRgZyNh\" target=\"_blank\">pic.twitter.com\/CwGwRgZyNh<\/a><\/p>\n<p>&mdash; \ud83d\udea8 Cyvers Alerts \ud83d\udea8 (@CyversAlerts) <a href=\"https:\/\/twitter.com\/CyversAlerts\/status\/1839284600461303958?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">September 26, 2024<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h2>The Vulnerability of Onyx Protocol Had Already Been Exploited in Other Protocols<\/h2>\n<p style=\"text-align: justify\">This hack is far from being an isolated incident. <strong>Onyx Protocol had already suffered an attack in October 2023<\/strong>, where<strong> $2.1 million<\/strong> was lost due to a rounding error in its code. Such vulnerabilities have become a <strong>concerning pattern<\/strong> within the <a href=\"https:\/\/crypto-economy.com\/defi-decentralized-finances\/\" target=\"_blank\" rel=\"noopener\">DeFi<\/a> ecosystem, as many developers choose to <strong>build on existing codes instead of developing new functionalities from scratch<\/strong>. If the base code presents security flaws, forks may inherit these weaknesses.<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-full wp-image-172262\" src=\"https:\/\/crypto-economy.com\/\/wp-content\/uploads\/2024\/09\/onyx-post-1.png\" alt=\"onyx protocol post\" width=\"825\" height=\"300\" srcset=\"https:\/\/crypto-economy.com\/\/wp-content\/uploads\/2024\/09\/onyx-post-1.png 825w, https:\/\/crypto-economy.com\/\/wp-content\/uploads\/2024\/09\/onyx-post-1-300x109.png 300w, https:\/\/crypto-economy.com\/\/wp-content\/uploads\/2024\/09\/onyx-post-1-768x279.png 768w\" sizes=\"(max-width: 825px) 100vw, 825px\" \/><\/p>\n<p style=\"text-align: justify\">Industry experts warn that <strong>the lack of an active community to oversee and maintain code security can lead to critical situations<\/strong>, as evidenced by recent attacks. Security firms like Halborn have pointed out that <strong>the vulnerability of <a href=\"https:\/\/onyx.org\/\" target=\"_blank\" rel=\"noopener\">Onyx Protocol<\/a> was known and had already been exploited in other protocols<\/strong> that also use Compound Finance code. Developers have been advised that when launching new markets, they should implement strategies to ensure that the total supply of assets does not drop to zero, which would make the protocol vulnerable.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR Onyx Protocol, a fork of Compound Finance, suffered a cyber attack that resulted in a loss of $3.8 million. The attackers exploited a known precision issue in the protocol&#8217;s code, which allowed for the swapping of stolen funds. This is not the first attack on the protocol, as $2.1 million had already been lost &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Onyx Protocol Loses $3.8M in Another DeFi Hack\u2014Funds Already Swapped\" class=\"read-more button\" href=\"https:\/\/crypto-economy.com\/onyx-protocol-loses-3-8m-in-another-defi-hack-funds-already-swapped\/#more-172260\" aria-label=\"More on Onyx Protocol Loses $3.8M in Another DeFi Hack\u2014Funds Already Swapped\">Read more<\/a><\/p>\n","protected":false},"author":34,"featured_media":172263,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[111,84,74],"tags":[4620,5264,4656,5287,4708],"_links":{"self":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/posts\/172260"}],"collection":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/users\/34"}],"replies":[{"embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/comments?post=172260"}],"version-history":[{"count":2,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/posts\/172260\/revisions"}],"predecessor-version":[{"id":172266,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/posts\/172260\/revisions\/172266"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/media\/172263"}],"wp:attachment":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/media?parent=172260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/categories?post=172260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/tags?post=172260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}