WETH

Base

Tornado Cash

Security

Tornado

<h4>Once more, the crypto sector experienced a hack. This time, the Base blockchain was the target of hackers’ attention. </h4> 
He managed to get away with an initial $994,500, followed by another $455k. Once more, a DeFi protocol was hacked. Security firm <a href="https://x.com/CyversAlerts" target="_blank" rel="noopener">Cyvers Alerts</a> reported first about this blockchain exploit. So, let’s look closely at this blockchain exploit on Base. 
<h5>Here’s What Happened During the Blockchain Exploit on Base</h5> 
At the core of this blockchain exploit, on Base, was a smart contract vulnerability. These were WETH or Wrapped Ether smart contracts. The attacker managed to influence its price and drained the funds. That’s how he managed to get his hands on the initial $993,000. The attacker managed to siphon another $455k in a few more exploits. This resulted in an attack that lasted a couple of hours. 
<blockquote class="twitter-tweet"> 
 <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">ALERT<img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">Our system detected multiple suspicious transactions involving unverified lending contracts on <a href="https://twitter.com/hashtag/Base?src=hash&amp;ref_src=twsrc%5Etfw">#Base</a> a few hours ago. 
 The attacker initially made a suspicious transaction, gaining approximately $993K from these unverified contracts. Most of these tokens were swapped and… <a href="https://t.co/FRo5gVhxCc">pic.twitter.com/FRo5gVhxCc</a> 
 — <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> Cyvers Alerts <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@CyversAlerts) <a href="https://twitter.com/CyversAlerts/status/1849717982194257991?ref_src=twsrc%5Etfw">October 25, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The oracle used for this WETH was also vulnerable. It relied on only a single pair with only $400k in liquidity. It was prone to price swings. In other words, the attacker could easily manipulate it. And so he did, with a flash loan attack. A flash loan is a loan where you don’t need collateral. That’s because you pay back the borrowed amount within the same transaction. 
Once the initial $993k was in the attackers’ wallet, he transferred it to the Ethereum network.&nbsp; From there, he funneled $202.5k to <a href="https://www.altcoinbuzz.io/?s=tornado+cash" target="_blank" rel="noopener">Tornado Cash</a>. This is a privacy-centered service, aka a tumbler. An easy explanation is that its input comes from various wallets. However, once it tumbles the various assets, the output is in such a way that you can’t track it. 
Since August 2022 Tornado Cash is illegal to use in the US for US citizens, residents, or companies. They’re great tools to keep your business transactions private. However, unfortunately, they’re also often used by money launderers. The picture below shows a part of the apparent attackers’ wallet. 
<img decoding="async" class="aligncenter wp-image-153991 size-large" src="https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-1024x463.png" alt="Blockchain exploit" width="696" height="315" srcset="https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-1024x463.png 1024w, https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-300x136.png 300w, https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-768x348.png 768w, https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-1536x695.png 1536w, https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-928x420.png 928w, https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-696x315.png 696w, https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_-1068x483.png 1068w, https://www.altcoinbuzz.io/wp-content/uploads/2024/10/FireShot-Pro-Webpage-Capture-654-Base-Transaction-Hash-Txhash-Details-I-BaseScan-basescan.org_.png 1920w" sizes="(max-width: 696px) 100vw, 696px"> 
Source: <a href="https://basescan.org/tx/0x6ab5b7b51f780e8c6c5ddaf65e9badb868811a95c1fd64e86435283074d3149e" target="_blank" rel="noopener">Basescan</a> 
<h6>Calls for Stronger Security Measures in DeFi</h6> 
There are plenty of calls, asking for stronger security measures in DeFi protocols. Some options can be, for instance, 
<ul> 
 <li style="font-weight: 400;" aria-level="1">Cut single points of failures. Make use of various decentralized oracles from different sources. If one fails, the others will still work and provide correct data.</li> 
 <li style="font-weight: 400;" aria-level="1">Decentralized oracles are harder to manipulate for attackers compared to centralized oracles.&nbsp;</li> 
 <li style="font-weight: 400;" aria-level="1">Make use of cryptographic proofs. These are mathematical algorithms. They can prove if statements are legit.</li> 
</ul> 
<h5>Conclusion</h5> 
DeFi smart contracts on <a href="https://www.altcoinbuzz.io/?s=base" target="_blank" rel="noopener">Base</a> saw a blockchain exploit to the tune of $993,000. The attacker used a flash loan to exploit smart contract vulnerabilities. There was also a single point of failure in play, with a weak oracle. As a result, there are calls to make DeFi more secure. 
<a href="https://www.patreon.com/altcoinbuzz" target="_blank" rel="noopener"><img decoding="async" class="alignnone wp-image-123700 size-full" src="https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner.jpg" sizes="(max-width: 1197px) 100vw, 1197px" srcset="https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner.jpg 1197w, https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner-300x37.jpg 300w, https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner-1024x127.jpg 1024w, https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner-768x95.jpg 768w, https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner-696x86.jpg 696w, https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner-1068x132.jpg 1068w" alt="" width="1197" height="148"></a> 
<iframe title="Solana vs Sui - Where to Invest $1000 for BIG Altcoin Profits?" width="696" height="392" src="https://www.youtube.com/embed/ceQxlwRcuyU?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe> 
Disclaimer 
The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment and informational purposes only. Any information or strategies are thoughts and opinions relevant to accepted levels of risk tolerance of the writer/reviewers, and their risk tolerance may be different from yours. 
We are not responsible for any losses that you may incur as a result of any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments, so please do your due diligence. 
Copyright Altcoin Buzz Pte Ltd. 
The post <a href="https://www.altcoinbuzz.io/cryptocurrency-news/1m-stolen-in-base-blockchain-exploit/">$1M Stolen in Base Blockchain Exploit</a> appeared first on <a href="https://www.altcoinbuzz.io">Altcoin Buzz</a>.

$1M Stolen in Base Blockchain Exploit

Altcoin Buzz

Other articles published on Oct 28, 2024

Will Global Liquidity Improve by 2025?

Is Microsoft About to Go All-In on Bitcoin? Here’s What to Know

Vitalik Buterin Aims for Sub-2 Second Transfers Between Chains in Ethereum’s Future

Investors Eye Qubetics Presale for 85,276% ROI While Cosmos and Infinite Protocol Growth Add Value

Solana wallet Phantom suffers downtime amid GRASS airdrop

Base stablecoin transaction volume briefly tops all other chains

Join our free newsletter for daily crypto updates!