Grimace

Solana

DeFi

<div>
 McDonald’s official Instagram account was hacked on Aug. 21. The hacked account promoted a fraudulent meme coin named “Grimace,” and the scammers got away with thousands of dollars worth of SOL.&nbsp; Meanwhile, new threats like the PG_MEM malware are targeting PostgreSQL-managed databases, while the notorious MEV bot “jaredfromsubway.eth” has resurfaced with upgraded capabilities.
 <h2 id="social-media-hack-results-in-700-000-solana-heist">Social Media Hack Results in $700,000 Solana Heist</h2>
 On Aug. 21, the official Instagram account of McDonald’s got hacked, and the attackers managed to steal more than $700,000 in Solana (SOL)&nbsp; by promoting a fraudulent meme coin named “Grimace.” The scammers took advantage of McDonald’s very large social media following of close to 5.1 million followers to falsely advertise the token as a legitimate experiment by the fast food giant on the Solana blockchain.
 Screenshots shared on X revealed that the hackers posted several updates about the token, and used McDonald’s iconic purple mascot, Grimace, to lure investors. Blockchain analytics service <a href="https://x.com/bubblemaps/status/1826317923717099549?s=46&amp;amp;t=MuRujqZUAz3TQE1vmr3c6A" target="_self" rel="noopener noreferrer nofollow">Bubblemaps</a> reported that the hackers initially acquired 75% of the Grimace token’s total circulating supply through a Solana meme coin deployer called Pump.fun. They then dispersed these tokens across approximately 100 different wallets.
 <a href="https://dexscreener.com/solana/ebv3fvhxjeq73wnvqedddlm1ug5jc3azqufv7r9lwye" target="_self" rel="noopener noreferrer nofollow">DexScreener data</a> revealed that the fraudulent promotion caused the Grimace token’s market cap to skyrocket from just a few thousand dollars to $25 million in just 30 minutes. However, the surge was quite short-lived as the hackers very quickly&nbsp;dumped their holdings.
 After executing the scam, the hackers edited McDonald’s Instagram bio to brag about their success. They also shared that they netted $700,000 in Solana from the rug pull. The posts and the altered bio were eventually removed, and McDonald’s was able to regain control of their account.
 Screenshot of McDonald’s hacked account (Source: X)
 In response to the incident, McDonald’s issued a statement to the <a href="https://nypost.com/2024/08/21/business/mcdonalds-instagram-page-hacked-in-700k-fake-crypto-scheme/" target="_self" rel="noopener noreferrer nofollow">New York Post</a>, and called the hack&nbsp;an “isolated incident” affecting its social media accounts. The company also assured people that the issue is resolved and apologized for any offensive content that was posted during the hack.
 <h2 id="new-cryptojacking-threat">New Cryptojacking Threat</h2>
 It is not just social media hacks pestering the crypto community. A <a href="https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/" target="_self" rel="noopener noreferrer nofollow">new malware</a> named PG_MEM has been discovered, and it is targeting PostgreSQL-managed databases to install cryptocurrency mining software. This malware poses a huge threat to the more than 800,000 PostgreSQL databases worldwide, particularly those with weak passwords.&nbsp;
 The attack starts with a brute force attempt to find a weak password. This allows the threat actor to gain access to the database. Once inside, the attacker creates a new user with high privileges, downloads files from their server, and secures the system to prevent other threat actors from exploiting the same database.
 The malware then connects to a mining pool, and uses the database’s computing resources to mine cryptocurrency. This is known as cryptojacking. Concerningly, these kinds of attacks are becoming more and more common. In fact, there has been a <a href="https://www.sonicwall.com/threat-report" target="_self" rel="noopener noreferrer nofollow">400% rise</a> in crypto-malware attacks in the first half of 2023 compared to the previous year.&nbsp;
 PG_MEM attack flow (Source: <a href="https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/" target="_self" rel="noopener noreferrer nofollow">Aqua</a>)
 PG_MEM is particularly concerning because it exploits a very common vulnerability in internet-facing databases. This vulnerability is weak passwords that result from misconfigurations and inadequate identity controls. Many organizations inadvertently expose their databases to these kinds of risks by connecting them to the internet without enough security measures.
 While cryptojacking is mostly&nbsp;seen as a threat, there are some who see potential in harnessing unused computing capacity for legitimate purposes. Companies like <a href="https://blog.aethir.com/blog-posts/aethir-partners-with-tensoropera-to-support-llm-and-ai-innovation" target="_self" rel="noopener noreferrer nofollow">Aethir</a>, which provides decentralized cloud infrastructure, use similar methods to offer scalable and cost-effective computing services by aggregating unused GPU capacity from data centers.&nbsp;
 <h2 id="revamped-mev-bot-targets-defi-protocols">Revamped MEV Bot Targets DeFi Protocols</h2>
 The infamous maximal extractable value (MEV) bot, known as “jaredfromsubway.eth,” has resurfaced with some new capabilities that allows it to execute more complex “sandwich” attacks on decentralized finance (DeFi) protocols. This bot <a href="https://x.com/sealaunch_/status/1648608182120378368?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1648608182120378368%7Ctwgr%5E0afbce199847ee0f7c914eb96b2fe1a7baa76be2%7Ctwcon%5Es1_&amp;amp;ref_url=https%3A%2F%2Fcointelegraph.com%2Fnews%2Fsubway-themed-trading-bot-makes-millions-using-sandwich-attacks" target="_self" rel="noopener noreferrer nofollow">earned millions</a> of dollars through arbitrage and sandwich attacks earlier in 2023, but has now been upgraded with new strategies that make it even more formidable.
 On Aug. 20, MEV tracking site <a href="https://eigenphi.substack.com/p/jared-2-cunninger-sandwiches" target="_self" rel="noopener noreferrer nofollow">EigenPhi</a> shared that a new MEV contract linked to the bot has emerged, which now employs sophisticated multi-layered sandwich attacks. These attacks involve scheduling transactions both in front of and behind a victim’s transaction to manipulate prices and extract profits at the expense of the victim. Over the past two weeks, this new contract has been seen using a number of advanced on-chain trade-squeezing methods.
 The bot operates by exploiting vulnerabilities in DeFi protocols, especially on <a href="https://coinpaper.com/3176/uniswap-vs-pancake-swap-comparing-top-decentralized-exchanges" target="_self" rel="noopener noreferrer nofollow">Uniswap</a> V3 pools, where it executes multiple transactions in the same block to manipulate exchange rates. This results in profits for the bot while causing losses for other users.&nbsp;
 The upgraded bot is called “Jared 2.0,” and now incorporates the addition and removal of liquidity in the decentralized exchange (DEX) pool as part of its sandwich attacks. This new tactic complicates the analysis and tracking of its profitability.
 According to EigenPhi, the original jaredfromsubway contract address facilitated trading strategies that paid out close to $2.2 million to other bots or traders over a two-week period starting on Aug. 1. However, activity on this contract started declining on Aug. 7, and eventually dropped to zero on Aug. 14.
 MEV attack volume (Source:<a href="https://eigenphi.io/" target="_self" rel="noopener noreferrer nofollow"> EigenPhi</a>)
 Despite the reduced activity on the original contract, sandwich attack volume passed $17 billion in the past month alone.
 <h2 id="crypto-whale-loses-55m-to-phishing-scam">Crypto Whale Loses $55M to Phishing Scam</h2>
 Meanwhile, a crypto whale lost $55 million in stablecoins after a phishing attack on Aug. 20. The incident happened when the wallet owner <a href="https://etherscan.io/tx/0xb721c8d603d5cbac826d804b04fb4662952afe91af15cf2aa603d002d3410b87" target="_self" rel="noopener noreferrer nofollow">unknowingly signed a malicious transaction</a>, which resulted in the transfer of 55.47 million DAI to a phishing address in the decentralized finance protocol Maker.&nbsp;
 The whale realized their mistake and tried to withdraw the funds to a new address, but this unfortunately did not work&nbsp; as the ownership of the wallet’s stablecoins had already been transferred.
 Blockchain analytics firm Lookonchain quickly flagged the incident, and revealed that the attackers exchanged 27.5 million DAI for 10,625 ETH after setting the wallet's ownership to a newly created address.&nbsp;
 Phishing attacks are a huge threat in the crypto space. They usually deceive victims into signing malicious transactions or installing fake software, which then leads to the theft of digital assets.&nbsp;
 These attacks have caused a lot of financial damage in 2024 already, with nearly half a billion dollars lost in the first half of the year alone. On July 3, blockchain security firm <a href="https://www.certik.com/resources/blog/hack3d-the-web3-security-quarterly-report-q2-h1-2024" target="_self" rel="noopener noreferrer nofollow">CertiK</a> reported that $498 million had been lost to phishing attacks.&nbsp;
 Luckily, some steps are being taken to fight these kinds of attacks. The Australian Federal Police (AFP) announced on Aug. 4 that it was investigating losses from phishing scams&nbsp;that affected 2,000 Australian-owned digital asset wallets.&nbsp;
 This is happening after findings by analytics firm Chainalysis uncovered that these wallets had been targeted by ”approval phishing” tactics. In response, the Australian Securities and Investments Commission (ASIC) reported that it took down over 5,530 fake investment platforms, 1,065 phishing links, and 615 crypto investment scams since July of 2023.
</div>

McDonald’s Instagram Hacked, Scammers Steal $700,000 in Solana

Table of Contents

Coinpaper.com

Other articles published on Aug 22, 2024

Altcoin Boom Like 2021 Post-US Election? Toncoin and Ripple Bullish Forecasts, Intel Markets Gear...

Pepe the Wizard (PEPEWIZZ) Solana Memecoin to Skyrocket Over 19,000% Before Exchange Listing, Whi...

Former TON Foundation execs establish new community initiative

Avalanche (AVAX) Skyrockets 17% as Grayscale Names Dedicated Trust

Real Vision CEO Raoul Pal Says Avoid Old Coins Like XRP. Here’s why

Exploring SOL’s 13% Q4 Growth, Starchain’s Astronomical Data Integration, and MoonBag Presale

Join our free newsletter for daily crypto updates!