Clipper

Decentralized exchange (DEX) Clipper clarified that a vulnerability in its withdrawal function allowed a recent $450,000 hack of its protocol, rather than a private key leak as suggested by a “third-party.” 
Clipper said in an X <a data-ct-non-breakable="null" href="https://x.com/Clipper_DEX/status/1863263893470003460" rel="null" target="null" text="null" title="null">post</a> that the attacker exploited two <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/defi-staking-proof-of-stake-pos-coins" rel="null" target="null" text="null" title="null">liquidity pools</a> on Dec. 1 and took about 6% of its total value locked. It added that no other pools were affected and the <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/8-most-common-cyberattacks-and-how-to-prevent-them" rel="null" target="null" text="null" title="null">exploit</a> had ended.
“There have been third-party claims suggesting a private key leak,” Clipper wrote. “We can confirm that this is not the case and is inconsistent with the design and security architecture of Clipper.”
“The ability to withdraw in the form of just one token (a bundled swap + deposit/withdrawal transaction) is disabled, because that seems to have been the exploited feature,” it added.
Earlier, the co-founder of security firm Fuzzland, Chaofan Shou, had <a data-ct-non-breakable="null" href="https://x.com/shoucccc/status/1863105036328615958" rel="null" target="null" text="null" title="null">posted</a> on X that Clipper was “hacked due to API vulnerability (like private key leak)” and added the API likely had vulnerabilities that allowed an attacker to sign deposit and withdrawal requests and pilfer more funds than they were putting in.
<figure>
 <img alt="Hacks, Decentralized Exchange, DEX" src="https://s3.cointelegraph.com/uploads/2024-12/019385da-bf35-7b2a-b32b-591d393d9de1" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/shoucccc/status/1863135055721419043" rel="null" target="null" text="null" title="https://x.com/shoucccc/status/1863135055721419043">Chaofan Shou</a>&nbsp;
 </figcaption>
</figure>
Clipper said it is investigating the incident and promised to provide further updates. It <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-exchange-xt-com-withdrawal-halt-1-7-million-hack" rel="null" target="null" text="null" title="null">has paused</a> swaps and deposits on its protocol. Withdrawals are open, but they “must be in the mix of all assets in the pool,” it said.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/spectral-labs-identifies-syntax-platform-vulnerability-pauses-contracts" rel="null" target="null" text="null" title="null">Spectral Labs identifies Syntax vulnerability, pauses contracts</a>&nbsp;
The project said that it’s tracing the stolen funds in an attempt to recover them and had asked the exploiter to contact the project if they’re “willing to speak.”
The hack adds to the <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-hackers-steal-71-m-in-november-brining-yearly-total-to-1" rel="null" target="null" text="null" title="null">over $1.48 billion</a> worth of crypto that’s been stolen in 2024 to the end of November, a 15% decrease compared to the same period last year, according to a Nov. 28 Immunefi report.
Clipper’s creator, Shipyard Software Inc., did not immediately respond to a request for comment outside of normal business hours. Shou was also asked to comment and had yet to respond.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/fbi-tokens-ai-crypto-wash-trades-is-it-legal/" rel="null" target="null" text="null" title="null">Legal issues surround the FBI’s creation of fake crypto tokens</a>&nbsp;

Clipper DEX says recent $450K hack wasn’t caused by private key leak

Cointelegraph

Other articles published on Dec 2, 2024

Why Is XRP Up Today?

WIF Could Turn Your $350 Into Double the Amount in the Next 90 Days, DOGE May Triple That, but a ...

Ripple CEO Issues New Statement as XRP Starts Approaching $3

Bitcoin Price Climbs Ahead of Presidential Election

HyperLiquid HYPE Token Launch: Everything You Need to Know

ADA’s $3 target back in play as rival altcoin aims to turn $544 into $54,400 in 58 days

Join our free newsletter for daily crypto updates!