LI.FI 駭客攻擊暴露跨鏈交易聚合器漏洞，用戶損失超過 1000 萬美元

去中心化金融（DeFi）領域經歷了顯著的成長，有望實現沒有銀行和監管的未來。然而，缺乏這些中介機構也使用戶面臨風險，包括詐騙和駭客攻擊。

Decentralized finance (DeFi) is meant to be a future without banks and regulation. But the absence of these intermediaries also leaves users exposed.

去中心化金融（DeFi）意味著一個沒有銀行和監管的未來。但這些中介機構的缺失也讓使用者面臨風險。

Recently, cross-chain transaction aggregator LI.FI became the latest target of a hack, highlighting a vulnerability that has already cost users over $10 million in stablecoins. And, according to security experts, more user funds could still be at risk.

最近，跨鏈交易聚合器 LI.FI 成為最新的駭客攻擊目標，該漏洞已導致用戶損失超過 1000 萬美元的穩定幣。而且，根據安全專家的說法，更多的用戶資金仍可能面臨風險。

Here's how the LI.FI protocol hack went down.

以下是 LI.FI 協定被駭客攻擊的過程。

DeFi hacks are getting creative. On Tuesday, July 16, crypto security firm Cyvers reported a security breach in the LI.FI protocol, a major cross-chain transaction aggregator.

DeFi 駭客變得越來越有創意。 7 月 16 日星期二，加密貨幣安全公司 Cyvers 報告了主要跨鏈交易聚合器 LI.FI 協議的安全漏洞。

The initial breach was detected on the Ethereum blockchain and later expanded to the Arbitrum network. The attack resulted in the theft of over $10 million in stablecoins, primarily USDC and USDT, which the attackers then began converting into ETH.

最初的漏洞是在以太坊區塊鏈上檢測到的，後來擴展到 Arbitrum 網路。這次攻擊導致超過 1000 萬美元的穩定幣被盜，主要是 USDC 和 USDT，然後攻擊者開始將其轉換為 ETH。

The LI.FI protocol team confirmed the breach after the incident was reported by the security firm. According to the team, the main vulnerability stemmed from an infinite approval setting for transactions, which allowed the attackers to pilfer all the funds.

安全公司報告該事件後，LI.FI 協議團隊確認了這起違規事件。據該團隊稱，主要漏洞源於交易的無限批准設置，這使得攻擊者能夠竊取所有資金。

How to protect yourself from the infinite approval exploit

如何保護自己免受無限批准利用

The infinite approval exploit occurs when users grant a smart contract unlimited permission to access their funds. This is convenient for repetitive transactions that don't require user confirmation every time, but it also introduces a major security risk. If the smart contract or platform is compromised, attackers can use it to drain all the funds from users.

當用戶授予智能合約無限的權限來存取其資金時，就會發生無限批准漏洞。這對於不需要每次都需要用戶確認的重複交易是方便的，但同時也帶來了重大的安全風險。如果智能合約或平台遭到破壞，攻擊者可以利用它來耗盡用戶的所有資金。

Sponsored

贊助

Revoke approvals: LI.FI claims that no further funds are at risk, but the Cyvers security firm is urging users to immediately revoke approvals for the compromised addresses. This can be done easily using tools like Revoke.cash.

撤銷批准：LI.FI 聲稱不再有資金面臨風險，但 Cyvers 安全公司敦促用戶立即撤銷對受損地址的批准。使用 Revoke.cash 等工具可以輕鬆完成此操作。

Inspect approvals: Users should periodically review their token approvals and revoke any that are no longer needed or that could pose a risk.

檢查批准：用戶應定期檢查其代幣批准，並撤銷任何不再需要或可能帶來風險的批准。

Set limits: Instead of granting infinite approval, users can specify a limit on the amount a smart contract can access. This way, even if there is a breach, the potential loss is capped.

設定限制：使用者可以指定智能合約可以存取的金額限制，而不是授予無限批准。這樣，即使發生違規，潛在的損失也受到限制。

While DeFi protocols are responsible for ensuring strong security measures, users also bear responsibility for their own security settings. Taking these steps can help reduce the risk of falling victim to hacks.

雖然 DeFi 協定負責確保強大的安全措施，但使用者也對自己的安全設定負責。採取這些步驟可以幫助降低成為駭客攻擊受害者的風險。

On the Flipside

另一方面

Why This Matters

為什麼這很重要

The LI.FI breach underscores the critical need for vigilance and proactive security measures in DeFi. Users must be cognizant of their security settings and take regular actions to manage permissions and safeguard their assets.

LI.FI 漏洞凸顯了 DeFi 中保持警覺和採取主動安全措施的迫切需求。使用者必須了解其安全設置，並定期採取措施來管理權限並保護其資產。

Learn more about protecting your funds:

了解有關保護您的資金的更多資訊：

How to Stay Safe From Phishing in Crypto Mailing List Hack

如何在加密郵件清單駭客攻擊中保持安全免受網路釣魚

Discover the Chromia Mainnet launch:

了解 Chromia 主網的發佈：

Chromia Mainnet Launch Sets the Stage for Next-Gen Blockchain Networks

Chromia 主網的發布為下一代區塊鏈網路奠定了基礎