Web3 网络钓鱼攻击导致价值 5500 万美元的 Dai 代币损失

最近的这一事件凸显了数字资产安全方面的漏洞。它还说明了 Web3 领域网络犯罪受害者增加的更广泛趋势。

A recent Web3 phishing attack has resulted in the loss of $55 million worth of Dai tokens, highlighting ongoing vulnerabilities in the security of digital assets. This incident also contributes to a broader trend of increasing cybercrime victimisation within the Web3 domain.

最近的一次 Web3 网络钓鱼攻击导致价值 5500 万美元的 Dai 代币丢失，凸显了数字资产安全中持续存在的漏洞。此事件还助长了 Web3 领域内网络犯罪受害人数增加的更广泛趋势。

The Dai tokens, valued at $55 million at the time of the attack, were stolen by an attacker identified as Fake_Phishing187019, according to a detailed post-mortem report by CertiK Alert on 21 August.

根据 CertiK Alert 8 月 21 日的详细事后分析报告，攻击时价值 5500 万美元的 Dai 代币被身份为 Fake_Phishing187019 的攻击者窃取。

"CertiK Alert: Fake_Phishing187019 (Inferno Drainer) set the owner address of a Maker vault to 0x5d4b2a02c59197eb2cae95a6df9fe27af60459d4 and minted 55,473,618 Dai tokens (~$55M) to it. Stay Vigilant! "

“CertiK 警报：Fake_Phishing187019 (Inferno Drainer) 将 Maker 金库的所有者地址设置为 0x5d4b2a02c59197eb2cae95a6df9fe27af60459d4，并向其铸造 55,473,618 Dai 代币（约 5500 万美元）。保持警惕！”

The attack involved the exploitation of weaknesses in externally owned accounts (EOAs), which are digital wallets that can be compromised if not adequately secured, akin to bank accounts. The stolen tokens were swiftly laundered through a complex trading network designed to obscure the movement of the tokens.

这次攻击涉及利用外部账户 (EOA) 的弱点，这些账户是数字钱包，如果没有充分保护，就可能会受到损害，类似于银行账户。被盗的代币很快通过一个复杂的交易网络被洗掉，该网络旨在掩盖代币的流动。

After stealing the Dai tokens, the attacker began laundering the funds through a bulk transfer of $36 million to an unidentified address followed by an additional $17.5 million routed through the CoW protocol.

窃取 Dai 代币后，攻击者开始通过向身份不明的地址批量转账 3600 万美元来洗钱，随后通过 CoW 协议再转移 1750 万美元。

Continuing efforts to conceal the assets saw the stolen funds being exchanged for bundles of ETH and Bitcoin through Uniswap V3, a decentralized cryptocurrency exchange. This method of theft underscores the criminal desire to efficiently hide and disperse stolen funds.

在继续隐藏资产的努力中，被盗资金通过去中心化加密货币交易所 Uniswap V3 兑换成大量 ETH 和比特币。这种盗窃方法凸显了犯罪分子想要有效隐藏和分散被盗资金的愿望。

The incident serves as the latest in a string of cyber attacks targeting Web3, highlighting an alarming trend. Scams, hacks, cyberattacks, and rugpulls have become common occurrences within the crypto and Web3 realm, and this new theft adds to the concerning narrative.

该事件是针对 Web3 的一系列网络攻击中的最新一起，凸显了令人震惊的趋势。诈骗、黑客攻击、网络攻击和拉动行为已成为加密货币和 Web3 领域的常见现象，而这种新的盗窃行为又加剧了人们的担忧。

According to CertiK, around $270.9 million was lost to various breaches, hacks, and fraud in July, of which only $7.8 million was recovered. The report details losses incurred from exit scams, flash loans, and other exploits, presenting a sobering account of the current security landscape.

据 CertiK 称，7 月份各种违规、黑客和欺诈造成了约 2.709 亿美元的损失，其中仅追回了 780 万美元。该报告详细介绍了退出诈骗、闪电贷款和其他漏洞造成的损失，对当前的安全形势进行了发人深省的描述。

"CertiK Stats Alert: Combining all the incidents in July we’ve confirmed ~$270.9m lost to exploits, hacks and scams after ~$7.8m was returned. The amount is the second highest monthly loss so far in 2024.

“CertiK 统计警报：结合 7 月份的所有事件，我们确认在退回约 780 万美元后，因漏洞利用、黑客攻击和诈骗而损失了约 2.709 亿美元。该金额是 2024 年迄今为止第二高的月度损失。

Exit scams: ~$3m

退出诈骗：约 300 万美元

Flash loans: ~$265.8m

闪电贷：约 2.658 亿美元

Exploits: ~$9.8m

漏洞利用：约 980 万美元

"

”

The recent WazirX hack, which resulted in a loss of $230 million, further exemplifies the sector's vulnerability.

最近的 WazirX 黑客攻击造成了 2.3 亿美元的损失，进一步说明了该行业的脆弱性。

Cryptocurrency scams exploit the decentralized nature of digital currencies, employing diverse tactics to swindle victims. These scams range from Ponzi schemes that collapse when new investments cease to flow, to phishing attacks that attempt to extract private keys through fake websites or emails, and ICO scams that vanish after collecting funds.

加密货币诈骗利用数字货币的去中心化性质，采用多种策略来欺骗受害者。这些骗局包括当新投资停止流动时崩溃的庞氏骗局，试图通过虚假网站或电子邮件提取私钥的网络钓鱼攻击，以及筹集资金后消失的 ICO 骗局。

Pump and dump schemes inflate prices before selling off their holdings, while exit scams involve sudden shutdowns that leave investors stranded without their money. Additionally, fake wallets and exchanges are used to steal funds, and malware or ransomware can lock data, holding it hostage for a ransom.

拉高抛售计划会在抛售所持股份之前抬高价格，而退出骗局则涉及突然关闭，导致投资者陷入资金短缺。此外，假钱包和交易所被用来窃取资金，恶意软件或勒索软件可以锁定数据，将其劫持以勒索赎金。

Finally, pyramid schemes rely on new recruits to pay earlier members in a collapsing chain of payments. To safeguard against these scams, users are advised to thoroughly research projects, verify their legitimacy, and employ security measures such as hardware wallets and two-factor authentication.

最后，传销依靠新招募的成员向早期成员支付报酬，从而形成一条崩溃的支付链。为了防范这些诈骗，建议用户彻底研究项目，验证其合法性，并采取硬件钱包和双因素身份验证等安全措施。