Symbiotic

The latest crypto scams, hacks and exploits and how to avoid them: Crypto-Sec
<h2 id="phish-of-the-week-symbiotic-x-account-is-compromised">Phish of the week: Symbiotic X account is compromised</h2>
According to a report from PeckShield, the X account for the staking protocol Symbiotic was <a data-ct-non-breakable="null" href="https://x.com/PeckShieldAlert/status/1842471316638810350" rel="null" target="null" text="null" title="null">hacked</a> on Oct. 5. The team’s official website said the account was still compromised as of Oct. 7. 
The compromised account promotes a “points” checklist and asks users to click on a link to check how many points they have. However, the link leads to the wrong URL, network-symbiotic[.]fi, instead of the correct one, symbiotic.fi.
<figure>
 <img alt="Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-10/019266dd-b060-7f9d-a525-daf6d2d92dcb" title="">
 <figcaption style="text-align: center;">
 Phishing post from Symbiotic X hacker. Source: <a data-ct-non-breakable="null" href="https://x.com/symbioticfi/status/1843163544164192416" rel="null" target="null" text="null" title="https://x.com/symbioticfi/status/1843163544164192416">Symbiotic</a>.
 </figcaption>
</figure>
When users connect to the fake phishing site with a wallet, they are presented with a page that claims they have earned thousands of points, even if they have never interacted with the Symbiotic protocol. 
The page urges users to redeem their points immediately and claims they will be lost if they do not click a large, green, “redeem” button in the middle of the screen.
<figure>
 <img alt="Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-10/019266de-8cc0-7aaa-8adc-eb2cdfba4809" title="">
 <figcaption style="text-align: center;">
 Fake Symbiotic site allegedly used for phishing attacks. Source: network-symbiotic.fi
 </figcaption>
</figure>
Pushing the “Redeem Points” button with an empty wallet results in an error message stating that the user should try a different wallet, with a standard error message found on phishing sites asking for message signatures. 
If a user’s wallet contains Symbiotic tokens, the site likely asks the user to sign a message, which is then used to drain the user’s tokens. Cointelegraph did not test the app with a wallet that had funds in it.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/new-scam-drains-wallets-without-user-approving-transaction" rel="null" target="null" text="null" title="null">New crypto scam drains users’ wallets without transaction approval</a>
From its official website, the Symbiotic team is currently <a data-ct-non-breakable="null" href="https://symbiotic.fi/" rel="null" target="null" text="null" title="null">warning</a> users that its X has been compromised and that users should not interact with any sites linked to the account.
<figure>
 <img alt="Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-10/019266df-7035-78b9-830a-6dfc9958d2d9" title="">
 <figcaption style="text-align: center;">
 Symbiotic warning of compromised X account. Source: Symbiotic.fi
 </figcaption>
</figure>
X account hacks have become a routine problem in the crypto space. Users should consider bookmarking the URL for apps they frequently use, as this is generally a more reliable way of getting to the correct website than relying on X links, although it is not 100% foolproof either. Users should be especially cautious when asked to sign a message written in code, as this is often, but not always, a sign of a phishing attack.
<h2 id="malware-corner-attackers-now-using-svg-files-to-lure-victims">Malware corner: Attackers now using SVG files to lure victims</h2>
Attackers are now using SVG image files to infect victims’ computers, according to a September report from HP’s Wolf Security team. 
The new method allows attackers to gain control of a victim’s computer through remote access trojan (RAT) software. Once the software is installed, the attackers use it to steal the victim’s website passwords, seed words, and other personal information. If the user owns cryptocurrency, these credentials are then used in further attempts to gain access to the user’s wallet and empty it.
Researchers found that the malware was <a data-ct-non-breakable="null" href="https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2024/" rel="null" target="null" text="null" title="null">disguised</a> as a ZIP archive that loaded when the image was opened in a browser. It also featured a .pdf file that loaded as a distraction for the victim while the malicious program was being downloaded and installed in the background.
According to Adobe, Scalable Vector Graphics (SVG) files <a data-ct-non-breakable="null" href="https://www.adobe.com/creativecloud/file-types/image/vector/svg-file.html" rel="null" target="null" text="null" title="null">store</a> images “via mathematical formulas based on points and lines on a grid” instead of through pixels. This means that they can be easily resized without losing their quality. In addition, they are written in XML code, which allows them to store text inside of themselves.&nbsp;
According to Mozilla, SVG files also <a data-ct-non-breakable="null" href="https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script" rel="null" target="null" text="null" title="null">contain</a> a “script” element that allows developers to embed executable programs within them. It is this scripting ability that the malware developers have reportedly learned to abuse.
HP researchers found an image that produces a ZIP archive when opened in a browser. If the user clicks on the archive, it opens a File Explorer window and begins to download a shortcut file. 
Clicking the shortcut causes a decoy .pdf file to load on the victim’s screen. Meanwhile, the device begins to copy various scripts and store them in the victim’s music, photos, and startup directories, allowing the program to persist over time.
<figure>
 <img alt="Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-10/019266e0-de15-7b57-9961-d402258c5cbd" title="">
 <figcaption style="text-align: center;">
 Malicious URL file in infected SVG and decoy .pdf meant to distract the user—source: HP Wolf Security.
 </figcaption>
</figure>
After copying these scripts onto the device, it runs them. The result is that a number of dangerous malware programs, including VenomRAT, AsyncRAT, Remcos and XWORM, are installed on the user’s device. Once the malware is installed, the attacker can take full control of the victim’s computer, swiping any files held within it.
Given this new attack vector, crypto users should exercise caution when interacting with SVG image files from sources they do not entirely trust. When opened, if an image loads other types of files, users should consider rejecting these files by closing the browser window.
<h2 id="fire-token-exploit-illustrates-risks-of-novel-tokens">Fire token exploit illustrates risks of novel tokens</h2>
Buying new tokens with novel features and unaudited contracts is often risky, as is illustrated by what happened to the FIRE token on Oct. 1.
The Uniswap pool for the token was drained of nearly all of its liquidity after an attacker exploited the token’s contract to repeatedly sell it at a higher and higher price each time. 
After the exploit, the token’s team immediately deleted their social accounts and vanished, implying that the project may have been a rug pull or exit scam from the start.
The token has not traded since Oct. 2, which implies that there may be so little liquidity for it that selling may be impossible.
The idea <a data-ct-non-breakable="null" href="https://firetoken.ca/" rel="null" target="null" text="null" title="null">presented</a> to FIRE investors was simple. According to its website, it was an “ultra-hyper-deflationary token.” Whenever holders sold their FIRE into the token’s Uniswap liquidity pool, it would automatically be sent to a burner address. This would cause the token supply to shrink, driving up the value of the FIRE held by those who didn’t sell.
<figure>
 <img alt="Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-10/019266e1-b8bf-708e-8490-f5cac3af6ecc" title="">
 <figcaption style="text-align: center;">
 Fire token website. Source: Fire.
 </figcaption>
</figure>
The token was launched at 8:00 am UTC on Oct. 1. About 90 seconds after the launch, an account ending in 1e2e <a data-ct-non-breakable="null" href="https://etherscan.io/tx/0xd20b3b31a682322eb0698ecd67a6d8a040ccea653ba429ec73e3584fa176ff2b" rel="null" target="null" text="null" title="null">drained</a> some $22,000 worth of Ether (<a data-ct-non-breakable="null" href="https://cointelegraph.com/ethereum-price" rel="" target="_self" text="null" title="https://cointelegraph.com/ethereum-price">ETH</a>) from the token’s liquidity pool. 
To accomplish this, it first took out a flash loan of 20 ETH from the lending platform Spark Protocol. Then it created a malicious contract that swapped the ETH for FIRE, then swapped it back, destroying the newly acquired FIRE in the process and raising its price.
This process was repeated through 122 transfers through 16 different smart contracts, with each transfer being part of a single transaction. Each time FIRE was swapped for ETH, a slightly larger amount of ETH was received in return. As a result, the attacker was able to drain the pool of the $22,000 worth of ETH. In addition, this transaction destroyed 230 FIRE tokens.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/new-scam-drains-wallets-without-user-approving-transaction" rel="null" target="null" text="null" title="https://cointelegraph.com/news/new-scam-drains-wallets-without-user-approving-transaction">New crypto scam drains users’ wallets without transaction approval</a>
The attack was repeated over and over again, with the final exploit transaction <a data-ct-non-breakable="null" href="https://etherscan.io/tx/0x393b6818a40a70abd67c1d1deec3f6907ae42d2d9e01237c399229b126e8523f" rel="null" target="null" text="null" title="null">taking</a> place on Oct. 2 at 1:14 am UTC. 
Blockchain security platform TenArmor reported the attack on X. “Our system has detected that #FIRE token @Fire_TokenEth on #ETH was attacked, resulting in an approximate loss of $22.3K,” the post stated.
<figure>
 <img alt="Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-10/019266e2-6bd0-7f7a-ab6e-17b7f411e9e6" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/TenArmorAlert/status/1841101523293798590" rel="null" target="null" text="null" title="https://x.com/TenArmorAlert/status/1841101523293798590">TenArmor</a>.
 </figcaption>
</figure>
According to price data from tthe rading platform Apespace, the initial price of FIRE was set at approximately 33 ETH ($81,543 at current prices) or around $8 per 0.0001 FIRE. At the moment of the exploit, the price of FIRE <a data-ct-non-breakable="null" href="https://apespace.io/eth/0x18775475f50557b96c63e8bbf7d75bfeb412082d" rel="null" target="null" text="null" title="null">skyrocketed</a>, increasing to 30 billion ETH per coin or $244.6 billion per 0.0001 FIRE. It then fell to 4.7 billion ETH per coin over the next two minutes. 
Note that by the time these high prices were reached, significantly less than one FIRE coin remained in circulation, as most of the token’s supply had been destroyed in the exploit.
<figure>
 <img alt="Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-10/019266e2-f9c6-71f7-b1c1-707c25152fb9" title="">
 <figcaption style="text-align: center;">
 FIRE one-minute chart showing exploit at approximately 8:13 am. Source: Apespace.
 </figcaption>
</figure>
After the exploit, the FIRE team deleted its X and Telegram accounts, which suggests that the attacker may have been affiliated with the team. The token’s Apespace page also features a warning that the FIRE contract contains a “blacklisting” feature allowing developers to blacklist any user’s account and prevent them from selling the token. The developers may have used this blacklisting feature to only allow themselves to sell.
Users should exercise caution when interacting with tokens that have novel features that may not be fully understood. 
In this case, the developers explicitly stated that anyone who sells into the pool destroys tokens, reducing their supply. Still, some users may not have realized that this allows a single trader to repeatedly swap into and out of the token to artificially raise its price and drain its liquidity.
<a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/crypto-scam-investigator-south-korea-us-nk-hackers-asia-express/" rel="" target="_self" text="null" title="https://cointelegraph.com/magazine/crypto-scam-investigator-south-korea-us-nk-hackers-asia-express/">Magazine: Suspicious arrest of crypto scam reporter, Japan’s pro-crypto PM: Asia Express</a>

Symbiotic X hacked, malware is infecting SVG files: Crypto-Sec

Table of Contents

Cointelegraph

Other articles published on Oct 7, 2024

Consensys Faces Setback as Court Dismisses Lawsuit Against SEC

Weekly Article Recap: 9/16-9/20

Top Crypto and Economic Events: October 7 – October 13, 2024

Scammers Discontinue Operations Targeting TON Network Users

Avalanche Foundation Launches $40M Retro9000 Grant Program for L1 Developers

EigenLayer Assures No Protocol Risk After $5.7M Hack

Join our free newsletter for daily crypto updates!