Bittensor

Million

Foundation

Security

In a recent incident, Bittensor, a prominent AI-focused project, was forced to <a href="https://bitcoinist.com/is-bittensor-safe-network-halted-after-8-million-vanishes-from-security-breach/" target="_blank" rel="noopener ">suspend its network operations</a> following a series of wallet hacks, resulting in a loss of at least $8 million worth of TAO, Bittensor’s native token.&nbsp; 
This incident comes just a month after another wallet breach that led to a loss of $11 million. The Bittensor team has now released a detailed report shedding light on the developments surrounding these attacks. 
<h2 id="root-causes-of-bittensor-s-wallet-hack">Root Causes Of Bittensor’s Wallet Hack</h2> 
According to the <a href="https://blog.bittensor.com/bittnesor-community-update-july-3-2024-45661b1d542d" target="_blank" rel="noopener nofollow">report</a>, at 7:41 PM UTC on Wednesday, the decision was made to place the Opentensor Chain Validators behind a firewall and activate safe mode on Subtensor due to the attack that affected multiple participants in the Bittensor community.&nbsp; 
The attack timeline indicates that the attacker initiated fund transfers from wallets to their wallet, which was detected by the Opentensor Foundation (OTF).&nbsp; 
A “war room” was reportedly established to respond to the abnormality in transfer volume. Eventually, the attack was neutralized by placing the<a href="https://bitcoinist.com/crypto-exchange-seeks-indian-approval-as-users-hit-roadblock/" target="_blank" rel="noopener "> Opentensor chain </a>validators behind a firewall and activating safe mode. This action halted all transactions, allowing for a comprehensive situational analysis of the attack. 
The root cause of the attack was traced back to the PyPi Package Manager version 6.12.2, where a malicious package was uploaded, compromising user security.&nbsp; 
This malicious package, disguised as a legitimate Bittensor file, contained code to steal unencrypted coldkey details. When users downloaded the package and decrypted their <a href="https://bitcoinist.com/xrp-lawsuit-sec-ripple-new-filing/" target="_blank" rel="noopener ">coldkeys</a>, the decrypted bytecode was sent to a remote server controlled by the attacker. 
The vulnerability is believed to have affected individuals who used Bittensor 6.12.2 and performed operations involving the decryption of hotkeys or coldkeys.&nbsp; 
Additionally, those who downloaded the Bittensor PyPi package between May 22, 7:14 PM UTC, and May 29, 6:47 PM UTC, and performed any relevant operations were also likely impacted. 
<h2 id="security-precautions-advised">Security Precautions Advised</h2> 
Immediate mitigation steps were taken by the OTF team, including removing the malicious 6.12.2 package from the PyPi Package Manager repository. So far, no other <a href="https://bitcoinist.com/shiba-inu-72453-surge-burn/" target="_blank" rel="noopener ">vulnerabilities </a>have been identified, but a comprehensive assessment of all potential attack vectors is ongoing. 
The Bittensor team has collaborated with several exchanges to provide attack details, trace the attacker, and potentially recover funds.&nbsp; 
As the code review nears completion, Opentensor plans to gradually resume normal operations of the Bittensor blockchain, allowing <a href="https://bitcoinist.com/grayscale-solana-trust-mega-650-premium/" target="_blank" rel="noopener ">transactions </a>to flow again.&nbsp; 
The team emphasizes taking precautions, such as creating new wallets and transferring funds once the blockchain is operational. Upgrading to the latest version of Bittensor is strongly advised to enhance security measures. 
Bittensor plans to investigate the breach with the PyPi maintainers and implement enhancements to prevent future incidents.&nbsp; 
These enhancements include stricter access and verification processes for packages uploaded to PyPi, increased frequency of security audits, implementation of best practices in public security policies, and heightened monitoring and logging of package uploads and downloads. 
<img loading="lazy" decoding="async" class="size-medium" src="https://www.tradingview.com/x/jIf9Bldv/" alt="Bittensor" width="1815" height="858"> 
At the time of writing, the project’s native token TAO is trading at $224, down over 42% in the last 30 days alone. However, the token still has significant gains of over 386% year-to-date. 
Featured image from DALL-E, chart from TradingView.com

Bittensor Reveals Vulnerability Behind $8 Million Exploit In New Report – Details

Table of Contents

Bitcoinist

Other articles published on Jul 5, 2024

Gamma Prime Introduces Next-Generation Protocol for Tokenizing Real Yield Strategies

MoonBag Secures Listing on LBank: Is Coinbase Next For The Highly Lucrative Meme Coin?

This Drop Can Be The Sign Of Upcoming Altcoins Season

UFC Star Khamzat Chimaev’s New SMASH Meme Coin Falls To Zero In Minutes Amid Insider Trading Claims

Mt Gox Movements Impact Bitcoin Prices

Toncoin: Examining what the future holds after TON’s 20% dip

Join our free newsletter for daily crypto updates!