Convergence 确认遭受 2.12 亿美元黑客攻击，恳求用户撤回资产

去中心化金融协议 Convergence 已确认其于 8 月 1 日被智能合约漏洞攻击，黑客铸造并出售了 2.1 亿美元

DeFi protocol Convergence has confirmed that it was hacked via a smart contract exploit on Aug. 1, with the attacker minting and selling $210 million in its native token, as well as stealing $2,000 in unclaimed staking rewards.

DeFi 协议 Convergence 已确认其于 8 月 1 日通过智能合约漏洞被黑客攻击，攻击者铸造并出售了 2.1 亿美元的原生代币，并窃取了 2,000 美元无人认领的质押奖励。

According to a post-mortem from Wireshark, the pseudonymous founder of the Convergence protocol, the attacker exploited the protocol’s CvxRewardDistributor contract, allowing them to mint and sell 58 million CVG tokens for approximately $210,000.

根据 Convergence 协议的匿名创始人 Wireshark 的事后分析，攻击者利用了该协议的 CvxRewardDistributor 合约，允许他们铸造 5800 万个 CVG 代币，并以大约 21 万美元的价格出售。

The attacker also stole approximately $2,000 of unclaimed rewards from Convex, a DeFi protocol designed to maximize rewards for Curve liquidity providers.

攻击者还从 Convex 窃取了约 2,000 美元无人认领的奖励，Convex 是一种 DeFi 协议，旨在最大限度地提高 Curve 流动性提供者的奖励。

According to Etherscan, the attack occurred on Aug. 1 at around 3:00 am UTC.

据 Etherscan 称，这次攻击发生在 UTC 时间 8 月 1 日凌晨 3:00 左右。

Blockchain security firm PeckShield noted that after minting the CVG tokens, the attacker quickly swapped it into 60 wrapped-Ether and 15,900 Curve.fi FRAX.

区块链安全公司 PeckShield 指出，在铸造 CVG 代币后，攻击者迅速将其兑换成 60 个包装以太币和 15,900 个 Curve.fi FRAX。

The movements have since led to a near-100% price wipeout of the CVG governance token, which is now trading at $0.0004 with a market cap of just $57,000, CoinMarketCap data shows.

CoinMarketCap 数据显示，这些变动导致 CVG 治理代币价格近 100% 下跌，目前该代币的交易价格为 0.0004 美元，市值仅为 57,000 美元。

Convergence said the attack was possible because the team accidentally removed an essential line of code in its smart contract, which distributes CVG staking rewards. They made the change after the smart contract code was audited four times.

Convergence 表示，此次攻击之所以可能发生，是因为该团队意外删除了智能合约中的一行重要代码，该代码用于分配 CVG 质押奖励。他们在智能合约代码经过四次审核后做出了更改。

“The modification (gas-optimization on the first hand) led us to remove the line of code that was checking the input given to the function,” it explained.

“修改（首先是气体优化）导致我们删除了检查函数输入的代码行，”它解释道。

The attacker used this to exploit the CvxRewardDistributor contract through the claimMultipleStaking function.

攻击者利用该漏洞通过 ClaimMultipleStake 函数来利用 CvxRewardDistributor 合约。

This meant the staking contract couldn’t be validated, allowing the attacker to pass a separate malicious contract with the same signature as the claimCvgCvxMultiple function.

这意味着质押合约无法得到验证，从而允许攻击者传递与 ClaimCvgCvxMultiple 函数具有相同签名的单独恶意合约。

The attacker then minted all tokens dedicated to staking emissions and then dumped them into CVG liquidity pools, Convergence said.

Convergence 表示，攻击者随后铸造了所有专门用于质押排放的代币，然后将它们转储到 CVG 流动性池中。

Convergence says that user funds are safe, but has recommended users withdraw assets from the platform.

Convergence表示用户资金是安全的，但建议用户从平台提取资产。

“Due to the exploit, the rewards contract for the Stake DAO integration is currently broken. It will be fixed, and stakers will be able to claim their rewards once it’s done. No rewards are lost for Stake DAO integration users," it said.

“由于该漏洞，Stake DAO 集成的奖励合约目前已被破坏。该问题将被修复，一旦完成，质押者将能够领取奖励。 Stake DAO 集成用户不会损失任何奖励。”

Convergence works to aggregate liquidity, boost returns and enable liquid locking across the Curve Finance ecosystem.

Convergence 致力于聚合流动性、提高回报并实现整个 Curve Finance 生态系统的流动性锁定。

The total value locked on Convergence fell from $5.79 million to $3.69 million, DefiLlama data shows.

DefiLlama 数据显示，Convergence 锁定的总价值从 579 万美元下降至 369 万美元。

The cryptocurrency ecosystem lost around $266 million to hacks in July, mostly coming from the $230 million hack of Indian trading platform WazirX on July 18.

7 月份，加密货币生态系统因黑客攻击损失了约 2.66 亿美元，其中大部分来自 7 月 18 日印度交易平台 WazirX 遭受的 2.3 亿美元黑客攻击。