DeFi
Squarespace Hacked – DeFi Wallets Emptied (Imaginary Money Stolen)
Cryptocurrency fans are losing their worthless tokens via phishing attacks on decentralized finance sites.
Hundreds of domains on Squarespace have been made vulnerable by a gaping security hole: According to the researchers, NYSE:SQSP allowed anyone to claim and hijack any domain migrated from the now-defunct Google Domains service. Naturally, the attackers targeted cryptocurrency sites (since most of them are run by people who don’t know what they’re doing).
Yes, this is yet another story of weak DeFi security. Today SB Blogwatchnothing of value was lost.
Your humble blogger I have selected these blog posts for your entertainment. Not to mention: Metallica in Punjab.
Failure
What is happening ? Bill Toulas reports: DNS hijacking targets crypto platforms registered with Squarespace
“Attack on SquareSpace Accounts”
A wave of coordinated DNS hijacking attacks is targeting decentralized finance (DeFi) cryptocurrency domains using registrar Squarespace, redirecting visitors to phishing sites hosting wallet drainers. … Those who entered information on the phishing sites should take immediate action, … including revoking smart contract approvals, changing passwords, and transferring funds to a new wallet.
…
While the exact cause … has yet to be determined, the compromised domains were all originally registered to Google Domains, which were then forcibly transferred to Squarespace in 2023 as part of an asset purchase agreement with Google. … However, as part of the transition to Squarespace, Multi-factor authentication has been disabled.
…
Other Squarespace customers have also reported receiving suspicious password reset emails, which could indicate that this is part of a broader credential attack on SquareSpace accounts. [We] I have reached out to Squarespace for comment on the situation, but we are still awaiting a response.
What went wrong? samczsun, tayvano and AndrewMohawk know What went wrong?:
“Stealing the domain efficiently”
Contrary to early reports, the attacks were not caused by user negligence, such as reusing weak passwords or not enabling multi-factor authentication. … By default, Squarespace does not require email verification for new accounts created with a password. … As it stands, Squarespace is simply not a viable option for anyone [who] requires deeper control over their domains.
…
Squarespace never considered the possibility that a malicious actor could create an account using an email address associated with a recently migrated domain before the legitimate owner of the email address created the account themselves. Unfortunately, many domain contributors never created their Squarespace account, either because they forgot they had been granted contributor access or because they didn’t anticipate the security implications of inaction, making it relatively easy for a malicious actor to get ahead of them.
…
If you’ve gained unauthorized access to a Squarespace account [and] have “owner” permissions, you can simply transfer domain…thus stealing the domain itself. [Or]if you have “manager” permissions, you can … modify DNS records. … Having a Google Workspace administrator account allows the threat actor … to access historical emails, anything in Google Drive, Google Calendar, Google Docs, etc. [and] to turn to third-party services such as custody services or other financial accounts.
ELI5? dboreham explain as if we were five years old:
What [Squarespace] did: Put a billion DNS registration accounts in a state of limbo where anyone… could guess the email address associated with an account, could… obtain valid authentication information for the account, …without any verification that it came from the owner of the associated email address.
That he has done ? Ido Ben-Natan spoke to Sebastian Sinclair: Hundreds of DeFi Protocol Front-Ends Still Under Threat
“Inferno Drainer Group”
The incident…involved attackers targeting DNS records hosted on Squarespace. These records were redirected to IP addresses associated with known malicious activity [hosting] a page that drains funds from connected wallets.
…
“The association with Inferno Drainer is clear [from the] “We shared onchain and offchain infrastructure,” Ben-Natan said. “This includes onchain wallet and smart contract addresses as well as offchain IP addresses and domains related to Inferno.”
…
It works by tricking users into signing malicious transactions that give the attacker control over their digital assets. … The Inferno Drainer group has been active for some time, targeting various DeFi protocols and exploiting different vulnerabilities.
Ah, the curse of Google’s dead products. WillPostForFood it looks hungry:
It’s clear that Squarespace is the culprit here. But damn, I’m still pissed that Google shut down Domains, and I can’t help but direct some anger at them by abandoning another product.
RIP, Google Domains. Denis agrees:
It’s a shame that Google let us down in this endeavor. They’ve done it so many times before that I thought they’d learned their lesson.
I tried moving my domains from Squarespace after looking at their control panel. And it’s… a pain to migrate your domains.
However, this is not directly Google’s fault. Squarespace deserves most of the blame – and ecofeco is not surprised:
Having used Squarespace on several occasions on behalf of clients, I can say that it’s a patently crappy ecosystem, so I’m not surprised that it has some glaring holes.
Let’s not forget that the “victims” are imaginary money sites. As Retired chemist observes that this scene is in the Dunning-Kruger AF style:
Cryptocurrency companies. You would think they would be both security conscious and reasonably savvy on these topics. The real world never ceases to amaze me.
In the meantime, The prize for “best nominative determinism” goes to cynical security: [You’re fired—Ed.]
Squarespace spends a lot on marketing. They probably don’t have money to hire engineers anymore.
And finally:
Lars and James are die-hard fans
Have you readSB Blogwatch by Richi Jennings. Richi handpicks the best blog posts, forums, and weirdest websites, so you don’t have to. Hate mail can be sent to@RiCHi, @richij, @richi@vmst.io, @richi.bsky.social Or sbbw@richi.uk. Consult your physician before reading. Your mileage may vary. Past performance does not guarantee future results. Do not look into the laser with the remaining eye. E&OE. 30.
Image sauce: Creativity103 (cc:by; leveled and cropped)
Recent articles by the author
DeFi
Pump.Fun is revolutionizing the Ethereum blockchain in terms of daily revenue
The memecoin launchpad saw the largest daily revenue in all of DeFi over the past 24 hours.
Memecoin launchpad Pump.Fun has recorded the highest gross revenue in all of decentralized finance (DeFi) in the last 24 hours, surpassing even Ethereum.
The platform has raised $867,429 in the past 24 hours, compared to $844,276 for Ethereum, according to DeFiLlama. Solana-based Telegram trading bot Trojan was the third-highest revenue generator of the day, as memecoin infrastructure continues to dominate in DeFi.
Pump.Fun generates $315 million in annualized revenue according to DeFiLlama, and has averaged $906,160 per day over the past week.
Income Ranking – Source: DeFiLlama
The memecoin frenzy of the past few months is behind Pump.fun’s dominance. Solana-based memecoins have been the main drug of choice for on-chain degenerates.
The app allows non-technical users to launch their own tokens in minutes. Users can spend as little as $2 to launch their token and are not required to provide liquidity up front. Pump.Fun allows new tokens to trade along a bonding curve until they reach a set market cap of around $75,000, after which the bonding curve will then be burned on Raydium to create a safe liquidity pool.
Pump.Fun generates revenue through accrued fees. The platform charges a 1% fee on transactions that take place on the platform. Once a token is bonded and burned on Raydium, Pump.fun is no longer able to charge the 1% fee.
Ethereum is the blockchain of the second-largest cryptocurrency, Ether, with a market cap of $395 billion. It powers hundreds of applications and thousands of digital assets, and backs over $60 billion in value in smart contracts.
Ethereum generates revenue when users pay fees, called gas and denominated in ETH, to execute transactions and smart contracts.
DeFi
DeFi technologies will improve trading desk with zero-knowledge proofs
DeFi Technologies, a Canadian company financial technology companyis set to enhance its trading infrastructure through a new partnership with Zero Computing, according to a July 30 statement shared with CryptoSlate.
The collaboration aims to integrate zero-knowledge proof tools to boost operations on the Solana And Ethereum blockchains by optimizing its ability to identify and execute arbitrage opportunities.
Additionally, it will improve the performance of its DeFi Alpha trading desk by enhancing its use of ZK-enabled maximum extractable value (MEV Strategies).
Zero knowledge Proof of concept (ZKP) technology provides an additional layer of encryption to ensure transaction confidentiality and has recently been widely adopted in cryptographic applications.
Optimization of trading strategies
DeFi Technologies plans to use these tools to refine DeFi Alpha’s ability to spot low-risk arbitrage opportunities. The trading desk has already generated nearly $100 million in revenue this year, and this new partnership is expected to further enhance its algorithmic strategies and market analysis capabilities.
Zero Computing technology will integrate ZKP’s advanced features into DeFi Alpha’s infrastructure. This upgrade will streamline trading processes, improve transaction privacy, and increase operational efficiency.
According to DeFi Technologies, these improvements will increase the security and sophistication of DeFi Alpha’s trading strategies.
The collaboration will also advance commercial approaches for ZK-enabled MEVs, a new concept in Motor vehicles which focuses on maximizing value through transaction fees and arbitrage opportunities within block production.
Additionally, DeFi Technologies plans to leverage Zero Computing technology to develop new financial products, such as zero-knowledge index exchange-traded products (ETPs).
Olivier Roussy Newton, CEO of DeFi Technologies, said:
“By integrating their cutting-edge zero-knowledge technology, we not only improve the efficiency and privacy of our transactions, but we also pave the way for innovative trading strategies.”
Extending Verifiable Computing to Solana
According to the release, Zero Computing has created a versatile, chain-agnostic platform for generating zero-knowledge proofs. The platform currently supports Ethereum and Solana, and the company plans to expand compatibility with other blockchains in the future.
The company added that it is at the forefront of introducing verifiable computation to the Solana blockchain, enabling complex computations to be executed off-chain with on-chain verification. This development represents a significant step in the expansion of ZKPs across various blockchain ecosystems.
Mentioned in this article
Latest Alpha Market Report
DeFi
Elastos’ BeL2 Secures Starknet Grant to Advance Native Bitcoin Lending and DeFi Solutions
Singapore, Asia, July 29, 2024, Chainwire
- Elastos BeL2 to Partner with StarkWare to Integrate Starknet’s ZKPs and Cairo Programming Language with BeL2 for Native DeFi Applications
- Starknet integration allows BeL2 to provide smart contracts and dapps without moving Bitcoin assets off the mainnet
- Starknet Exchange Validates the Strength of BeL2’s Innovation and Leadership in the Native Bitcoin Ecosystem
Elastos BeL2 (Bitcoin Elastos Layer2) has secured a $25,000 grant from Starknet, a technology leader in the field of zero-knowledge proofs (ZKPs). This significant approval highlights the Elastos BeL2 infrastructure and its critical role in advancing Bitcoin-native DeFi, particularly Bitcoin-native lending. By integrating Starknet’s ZKPs and the Cairo programming language, Elastos’ BeL2 will enhance its ability to deliver smart contracts and decentralized applications (dapps) without moving Bitcoin (BTC) assets off the mainnet. This strategic partnership with Starknet demonstrates the growing acceptance and maturity of the BeL2 infrastructure, reinforcing Elastos’ commitment to market leadership in the evolving Bitcoin DeFi market.
Starknet, developed by StarkWare, is known for its advancements in ZKP technology, which improves the privacy and security of blockchain transactions. ZKPs allow one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. This technology is fundamental to the evolution of blockchain networks, which will improve BeL2’s ability to integrate complex smart contracts while preserving the integrity and security of Bitcoin.
“We are thrilled to receive this grant from Starknet and announce our partnership to build tighter integrations with its ZKP technology and the Cairo programming language,” said Sasha Mitchell, Head of Bitcoin Layer 2 at Elastos. “This is a major milestone for BeL2 and a true recognition of the maturity and capabilities of our core technology. This support will allow us to further develop our innovation in native Bitcoin lending as we look to capitalize on the growing acceptance of Bitcoin as a viable alternative financial system.”
A closer integration with Cairo will allow BeL2 to leverage this powerful programming language to enhance Bitcoin’s capabilities and deliver secure, efficient, and scalable decentralized finance (DeFi) applications. Specifically, the relationship with Cairo reinforces BeL2’s core technical innovations, including:
- ZKPs ensure secure and private verification of transactions
- Decentralized Arbitrage Using Collateralized Nodes to Supervise and Enforce Fairness in Native Bitcoin DeFi
- BTC Oracle (NYSE:) facilitates cross-chain interactions where information, not assets, is exchanged while Bitcoin remains on the main infrastructure
BeL2’s vision goes beyond technical innovation and aims to innovate by creating a new financial system. The goal is to build a Bitcoin-backed Bretton Woods system, address global debt crises, and strengthen Bitcoin’s role as a global hard currency. This new system will be anchored in the integrity and security of Bitcoin, providing a stable foundation for decentralized financial applications.
As integration with Starknet and the Cairo programming language continues, BeL2 will deliver further advancements in smart contract capabilities, decentralized arbitration, and innovative financial products. At Token 2049, BeL2 will showcase further innovations in its core technologies, including arbitrators, that will underscore Elastos’ vision for a fairer decentralized financial system rooted in Bitcoin.
About Elastos
Elastos is a public blockchain project that integrates blockchain technology with a suite of redesigned platform components to produce a modern Internet infrastructure that provides intrinsic privacy and ownership protection for digital assets. The mission is to create open source services that are accessible to the world, so developers can create an Internet where individuals own and control their data.
The Elastos SmartWeb platform enables organizations to recalibrate how the Internet operates to better control their own data.
https://www.linkedin.com/company/elastosinfo/
ContactPublic Relations ManagerRoger DarashahElastosroger.darashah@elastoselavation.org
DeFi
Compound Agrees to Distribute 30% of Reserves to COMP Shareholders to End Alleged Attack on Its Governance
Compound will introduce the staking program in exchange for Humpy, a notorious whale accused of launching a governance attack on the protocol, negating a recently adopted governance proposal.
Compound is launching a new staking program for COMP holders as a compromise with Humpy, a notorious DeFi whale accused of launching a governance attack against the veteran DeFi protocol.
On July 29, Bryan Colligan, head of business development at Compound, published a governance proposal outlining plans for a new compound participation product that would pay 30% of the project’s current and future reserves to COMP participants.
Colligan noted that the program was requested by Humpy in exchange for his agreement Proposition 289 — which sought to invest 499,000 COMP worth approximately $24 million into a DeFi vault controlled by Humpy, and which appears to have been forced by Humpy and his associates over the weekend.
“We propose the following staking product that meets Humpy’s stated interests as a recent new delegate and holder of COMP in exchange for the repeal of Proposition 289 due to the governance risks it poses to the protocol,” Colligan said. “The Compound Growth Program…will execute the above commitments, given the immediate repeal of Proposition 289.”
Colligan added that the proposal would expire at 11:59 p.m. EST on July 29. Had Humpy not rescinded Proposition 289, Compound would move forward with it. Proposition 290 — block Humpy using the Compound team’s multi-sig to deploy a new governor contract removing the delegate’s governance power behind Proposition 289.
Hunchback tweeted that Proposition 289 had been repealed a few hours ago. “Glad to have brought Compound Finance back into the spotlight,” they said. added. “StakedComp… finally becomes a yield-generating asset!
Markets reacted favorably to the resolution, with the price of COMP increasing by 6.2% over the past 24 hours, according to CoinGecko.
Attack on governance
Proposition 289 proposed investing 499,000 COMP from the Compound treasury into goldCOMP, a yield-generating vault of the Humpy-linked Golden Boys team.
The proposal passed with nearly 52 percent of the vote on July 28, despite two previous iterations of the proposal being defeated by strong opposition. Can And JulyThe proposals notably asked for only 92,000 COMP, with security researchers warning that any deposit of tokens into the goldCOMP vault would cede their governance power.
In May, Michael Lewellen of Web3 security firm OpenZeppelin, note The first proposal was submitted by a new governance delegate who was suddenly awarded 228,000 COMP by five wallets that got their tokens from the Bybit exchange. Combined with his own tokens, the delegate got 325,333 COMP, which is over 81% of the 400,000 tokens required for a governance proposal to reach quorum.
“We have been alerting the community to the risk that these delegates could support a potential attack on governance,” Lewellen said. “The timing of the new proposal and these recent delegations are suspect.”
Read more: Compound community accuses famous whale of attacking engineering governance
-
News9 months ago
Leeds hospitals trust says finances are “critical” amid £110m deficit
-
News6 months ago
Modiv Industrial to release Q2 2024 financial results on August 6
-
News6 months ago
Volta Finance Limited – Director/PDMR Shareholding
-
News9 months ago
Inventiva reports 2024 First Quarter Financial Information¹ and provides a corporate update
-
DeFi9 months ago
🏴☠️ Pump.Fun operated by Insider Exploit
-
News6 months ago
Apple to report third-quarter earnings as Wall Street eyes China sales
-
News6 months ago
Number of Americans filing for unemployment benefits hits highest level in a year
-
Videos9 months ago
“We will enter the ‘banana zone’ in 2 WEEKS! Cryptocurrency prices will quadruple!” – Raoul Pal
-
Tech9 months ago
Bitcoin’s Correlation With Tech Stocks Is At Its Highest Since August 2023: Bloomberg ⋆ ZyCrypto
-
Tech9 months ago
Everything you need to know
-
Markets8 months ago
Whale Investments in Bitcoin Hit $100 Billion in 2024, Fueling Insane Investor Optimism ⋆ ZyCrypto
-
Markets8 months ago
Crazy $3 Trillion XRP Market Cap Course Charted as Ripple CEO Calls XRP ETF “Inevitable” ⋆ ZyCrypto