rjohnson11
https://www.techpowerup.com/289569/badgerdao-sees-usd-120-million-crypto-heist-via-cloudflare-hack
 
BadgerDAO, "one of the most security-minded DAOs in operation", has been hit with a cryptocurrency heist enabled via a JavaScript hack on their website. BadgerDAO enables Bitcoin holders to "bridge" their cryptocurrency over to the smart-contract and DeFi-enabled Ethereum platform via its token, thus allowing access to the world of decentralized finance. After preliminary investigations aided by blockchain security and data analytics Peckshield, it seems that the bad actors inserted a malicious script in the BadgerDAO website - in turn intercepting Web3 transactions and inserting a request to transfer the victim's tokens to the attacker's chosen address. It's currently estimated that around $120 million were siphoned off via this attack. A single transfer saw 896 Bitcoin being diverted this way - a cool $50 million.

As soon as BadgerDAO became aware of suspect wallet activity, the company immediately froze all smart contracts running in its platform - a way to stem the bleeding until the security audit could be conducted. Thursday night, BadgerDAO announced it had "retained data forensics experts Chainalysis to explore the full scale of the incident & authorities in both the US & Canada have been informed & Badger is cooperating fully with external investigations as well as proceeding with its own."
 
Acording to BadgerDAO, the attacker managed to access the Cloudflare API used by the company without triggering the two-factor authentication protection that should have been enabled. Of course, two-factor (or multi-factor) authentication can and has been subverted before; there have been multiple instances of phishing attempts that manage to cross the bridge over to 2FA keys, and there are even toolkits available that automate the entire process. While it's still one of the most cost-effective ways to increase security access whenever credentials are involved, like every security measure, it requires attentive user interactions.
 
The poor security will probably open the door to lawsuits in my personal opinion. 
 
 

ty_ger07
It's funny how websites continue to cause cryptocurrency to be stolen when it is otherwise impossible to steal. When will this end? There should be money in it for someone who finds a solution.

Grey_Beard

ty_ger07
It's funny how websites continue to cause cryptocurrency to be stolen when it is otherwise impossible to steal. When will this end? There should be money in it for someone who finds a solution.

Eventually you will realize the money is in the theft not stopping it.  You mention this is impossible to steal while posting in a thread about it getting stolen.  Hmmm.

Miguell

nomoss
All the tears I shed for people losing their environment destroying "currency" could fit on the head of a pin.

 
you and me  both
unfortunately people want easy money,. its and old human desire !
 
crypto provides just that and it wont die .. as a matter of fact  i believe most of the people who lost big chucks of their savings... will enter the crypto market again... as soon as they can..
 
already saw a documentary about this.. and they admit that despite losing they would try again because....  its easy money!
 
greed will beat the will to have a 9 to 5 job for 40 years any day...
 
 

Nereus
 
Soon as Bitcoin and other cryptocurrencies are recognized as official legal tender (like El Salvador has), then this effectively becomes a very large bank heist. People who hack into and rob banks get serious jail time. The same should apply for crypto. Until then, it's basically a digital California - take whatever you want, nobody is going to do anything about it other than maybe give a light smack on the hand for being naughty, and for the victims.. cry me a river.