Sonne Finance 黑客攻击导致 2000 万美元加密货币被盗，引发安全担忧

借贷协议 Sonne Finance 成为网络攻击的受害者，导致 2000 万美元的加密货币被盗。攻击者利用 Sonne 的Compound v2 分叉中的错误，窃取了 Wrapped Ether (WETH)、VELO、soVELO 和 Wrapped USDC。调查正在进行中，包括为黑客提供漏洞赏金以取回被盗资金。尽管付出了努力，黑客已经洗掉了很大一部分被盗资产，使得追回变得困难。

Sonne Finance Hack Exposes $20 Million Cryptocurrency Theft, Raising Concerns About Security Practices

Sonne Finance 黑客事件曝光 2000 万美元的加密货币失窃事件，引发人们对安全实践的担忧

In a brazen cyberattack that has sent shockwaves through the cryptocurrency community, lending protocol Sonne Finance has been forced to suspend operations after suffering a hack that siphoned $20 million worth of digital assets from the market. The incident has raised serious questions about the security protocols employed by cryptocurrency platforms and the potential risks faced by investors.

在一场震惊整个加密货币社区的无耻网络攻击中，借贷协议 Sonne Finance 遭受黑客攻击，导致市场上价值 2000 万美元的数字资产被盗走，因此被迫暂停运营。该事件引发了人们对加密货币平台采用的安全协议以及投资者面临的潜在风险的严重质疑。

On May 14th, around 10:30 pm UTC, Web3 security firm Cyvers detected a sophisticated attack targeting Sonne Finance's USD Coin (USDC) and Wrapped Ether (WETH) contracts. However, by the time Sonne Finance became aware of the situation 25 minutes later, the hacker had already stolen a substantial amount of cryptocurrency, including $20 million in WETH, VELO, soVELO, and Wrapped USDC.

5 月 14 日，世界标准时间晚上 10:30 左右，W​​eb3 安全公司 Cyvers 检测到针对 Sonne Finance 的美元硬币 (USDC) 和 Wrapped Ether (WETH) 合约的复杂攻击。然而，当Sonne Finance在25分钟后意识到情况时，黑客已经窃取了大量加密货币，其中包括价值2000万美元的WETH、VELO、soVELO和Wrapped USDC。

"All markets on Optimism have been paused," Sonne Finance announced on Twitter shortly after learning of the breach. The protocol immediately partnered with Cyvers to investigate the incident and determine the extent of the damage.

Sonne Finance 在获悉此次泄露事件后不久在 Twitter 上宣布：“所有 Optimism 市场均已暂停。”该协议立即与 Cyvers 合作调查该事件并确定损害程度。

Stolen Funds Disappear into the Blockchain

被盗资金消失在区块链中

Sonne Finance is actively exploring all options to recover the stolen funds, including negotiating a bug bounty with the hacker. In such arrangements, the hacker typically returns the majority of the stolen funds and keeps a portion as a reward for discovering a security flaw.

Sonne Finance 正在积极探索追回被盗资金的所有选项，包括与黑客协商漏洞赏金。在这种安排中，黑客通常会返还大部分被盗资金，并保留一部分作为发现安全漏洞的奖励。

However, the hacker behind the Sonne Finance attack appears uninterested in negotiations. According to blockchain investigator PeckShield, the exploiter has already moved $7.8 million of the stolen funds to a new wallet address.

然而，Sonne Finance 攻击背后的黑客似乎对谈判不感兴趣。据区块链调查员 PeckShield 称，攻击者已将 780 万美元的被盗资金转移到新的钱包地址。

The hacker then exchanged 59 WBTC for approximately 1,185 ETH and 183,000 Dai. This move suggests an attempt to launder the stolen funds through a privacy protocol like Tornado Cash, making them difficult to trace.

随后，黑客将 59 WBTC 兑换为约 1,185 ETH 和 183,000 Dai。此举表明有人试图通过 Tornado Cash 等隐私协议来清洗被盗资金，从而使其难以追踪。

Sonne Finance's Security Lapses Questioned

Sonne Finance 安全漏洞遭质疑

A post-mortem analysis conducted by Sonne Finance revealed that a donation attack was executed against the protocol's Compound v2 forks, which reportedly had a known vulnerability. Community member PoorBabyCorn accused Sonne Finance of using Compound v2 despite being aware of these risks and questioned whether this constituted "a premeditated backdoor."

Sonne Finance 进行的事后分析显示，捐赠攻击是针对该协议的 Compound v2 分叉执行的，据报道该分叉存在已知漏洞。社区成员PoorBabyCorn指责Sonne Finance尽管意识到这些风险，仍然使用Compound v2，并质疑这是否构成“有预谋的后门”。

BlockTower Capital Hedge Fund Also Targeted

BlockTower Capital 对冲基金也成为目标

Concurrently with the Sonne Finance attack, reports emerged that the main hedge fund of crypto institutional investment firm BlockTower Capital had also been exploited and partially drained. The stolen funds, whose value has not been disclosed, have not been recovered.

在 Sonne Finance 遭受攻击的同时，有报道称加密机构投资公司 BlockTower Capital 的主要对冲基金也遭到利用并部分流失。被盗资金尚未被追回，其价值尚未披露。

BlockTower has enlisted the services of blockchain forensic analysts to trace the stolen funds and investigate the security breach. The exploiter remains at large, according to Bloomberg, citing sources familiar with the situation.

BlockTower 已聘请区块链取证分析师提供服务来追踪被盗资金并调查安全漏洞。彭博社援引知情人士的话称，这名剥削者仍然逍遥法外。

BlockTower's Previous Exploit

BlockTower 之前的漏洞

In February 2022, BlockTower reportedly lost around $1.5 million in an exploit targeting the multichain exchange aggregator Dexible. On-chain intelligence platform Arkham Intelligence linked a wallet drained of $1.5 million to BlockTower, suggesting that the firm was significantly impacted by the Dexible attack.

据报道，2022 年 2 月，BlockTower 在针对多链交易聚合器 Dexible 的攻击中损失了约 150 万美元。链上情报平台 Arkham Intelligence 将一个被盗 150 万美元的钱包与 BlockTower 关联起来，表明该公司受到 Dexible 攻击的严重影响。

Industry Concerns and Lessons Learned

行业担忧和经验教训

The Sonne Finance and BlockTower Capital hacks serve as stark reminders of the ongoing cybersecurity threats faced by the cryptocurrency industry. These incidents highlight the need for robust security protocols, thorough due diligence, and constant vigilance against malicious actors.

Sonne Finance 和 BlockTower Capital 的黑客事件清楚地提醒人们，加密货币行业正在面临持续的网络安全威胁。这些事件凸显了强大的安全协议、彻底的尽职调查以及对恶意行为者持续警惕的必要性。

As the cryptocurrency ecosystem continues to grow and evolve, it is imperative for exchanges, protocols, and institutional investors to invest in state-of-the-art security measures to protect their assets and the trust of their customers. The industry must also prioritize collaboration and information sharing to enhance collective preparedness against cyberattacks.

随着加密货币生态系统的不断发展和发展，交易所、协议和机构投资者必须投资最先进的安全措施，以保护其资产和客户的信任。该行业还必须优先考虑协作和信息共享，以加强针对网络攻击的集体准备。

The consequences of security breaches can be severe, not only in terms of financial losses but also in reputational damage and erosion of investor confidence. By adopting best practices, implementing robust security frameworks, and promoting a proactive approach to cybersecurity, the cryptocurrency industry can mitigate these risks and maintain its long-term viability.

安全漏洞的后果可能很严重，不仅会造成经济损失，还会导致声誉受损和投资者信心受损。通过采用最佳实践、实施强大的安全框架并推广积极主动的网络安全方法，加密货币行业可以减轻这些风险并保持其长期生存能力。