LI.FI 黑客攻击暴露跨链交易聚合器漏洞，用户损失超过 1000 万美元

去中心化金融（DeFi）领域经历了显着的增长，有望实现没有银行和监管的未来。然而，缺乏这些中介机构也使用户面临风险，包括诈骗和黑客攻击。

Decentralized finance (DeFi) is meant to be a future without banks and regulation. But the absence of these intermediaries also leaves users exposed.

去中心化金融（DeFi）意味着一个没有银行和监管的未来。但这些中介机构的缺失也让用户面临风险。

Recently, cross-chain transaction aggregator LI.FI became the latest target of a hack, highlighting a vulnerability that has already cost users over $10 million in stablecoins. And, according to security experts, more user funds could still be at risk.

最近，跨链交易聚合器 LI.FI 成为最新的黑客攻击目标，该漏洞已导致用户损失超过 1000 万美元的稳定币。而且，根据安全专家的说法，更多的用户资金仍可能面临风险。

Here's how the LI.FI protocol hack went down.

以下是 LI.FI 协议被黑客攻击的过程。

DeFi hacks are getting creative. On Tuesday, July 16, crypto security firm Cyvers reported a security breach in the LI.FI protocol, a major cross-chain transaction aggregator.

DeFi 黑客变得越来越有创意。 7 月 16 日星期二，加密货币安全公司 Cyvers 报告了主要跨链交易聚合器 LI.FI 协议的安全漏洞。

The initial breach was detected on the Ethereum blockchain and later expanded to the Arbitrum network. The attack resulted in the theft of over $10 million in stablecoins, primarily USDC and USDT, which the attackers then began converting into ETH.

最初的漏洞是在以太坊区块链上检测到的，后来扩展到 Arbitrum 网络。这次攻击导致超过 1000 万美元的稳定币被盗，主要是 USDC 和 USDT，然后攻击者开始将其转换为 ETH。

The LI.FI protocol team confirmed the breach after the incident was reported by the security firm. According to the team, the main vulnerability stemmed from an infinite approval setting for transactions, which allowed the attackers to pilfer all the funds.

安全公司报告该事件后，LI.FI 协议团队确认了此次违规事件。据该团队称，主要漏洞源于交易的无限批准设置，这使得攻击者能够窃取所有资金。

How to protect yourself from the infinite approval exploit

如何保护自己免受无限批准利用

The infinite approval exploit occurs when users grant a smart contract unlimited permission to access their funds. This is convenient for repetitive transactions that don't require user confirmation every time, but it also introduces a major security risk. If the smart contract or platform is compromised, attackers can use it to drain all the funds from users.

当用户授予智能合约无限的权限来访问其资金时，就会发生无限批准漏洞。这对于不需要每次都需要用户确认的重复交易来说是方便的，但同时也带来了重大的安全风险。如果智能合约或平台遭到破坏，攻击者可以利用它来耗尽用户的所有资金。

Sponsored

赞助

Revoke approvals: LI.FI claims that no further funds are at risk, but the Cyvers security firm is urging users to immediately revoke approvals for the compromised addresses. This can be done easily using tools like Revoke.cash.

撤销批准：LI.FI 声称不再有资金面临风险，但 Cyvers 安全公司敦促用户立即撤销对受损地址的批准。使用 Revoke.cash 等工具可以轻松完成此操作。

Inspect approvals: Users should periodically review their token approvals and revoke any that are no longer needed or that could pose a risk.

检查批准：用户应定期检查其代币批准，并撤销任何不再需要或可能带来风险的批准。

Set limits: Instead of granting infinite approval, users can specify a limit on the amount a smart contract can access. This way, even if there is a breach, the potential loss is capped.

设置限制：用户可以指定智能合约可以访问的金额限制，而不是授予无限批准。这样，即使发生违规，潜在的损失也受到限制。

While DeFi protocols are responsible for ensuring strong security measures, users also bear responsibility for their own security settings. Taking these steps can help reduce the risk of falling victim to hacks.

虽然 DeFi 协议负责确保强大的安全措施，但用户也对自己的安全设置负责。采取这些步骤可以帮助降低成为黑客攻击受害者的风险。

On the Flipside

另一方面

Why This Matters

为什么这很重要

The LI.FI breach underscores the critical need for vigilance and proactive security measures in DeFi. Users must be cognizant of their security settings and take regular actions to manage permissions and safeguard their assets.

LI.FI 漏洞凸显了 DeFi 中保持警惕和采取主动安全措施的迫切需要。用户必须了解其安全设置，并定期采取措施来管理权限并保护其资产。

Learn more about protecting your funds:

了解有关保护您的资金的更多信息：

How to Stay Safe From Phishing in Crypto Mailing List Hack

如何在加密邮件列表黑客攻击中保持安全免受网络钓鱼

Discover the Chromia Mainnet launch:

了解 Chromia 主网的发布：

Chromia Mainnet Launch Sets the Stage for Next-Gen Blockchain Networks

Chromia 主网的发布为下一代区块链网络奠定了基础