DeFi

Clipper

Clipper, a decentralized exchange (DEX), has revealed that a <a href="https://thecoinrise.com/binance-strengthens-security-in-battle-against-clipper-malware/" rel="noopener noreferrer nofollow">vulnerability in its withdrawal function</a> led to the recent $450,000 hack.
The protocol clarified in a December 1 <a href="https://x.com/Clipper_DEX/status/1863263893470003460" rel="noopener noreferrer nofollow">statement</a> on X that contrary to earlier claims by third parties, the exploit was not due to a private key leak but rather a design flaw within its withdrawal process.
<h2 id="span-style-font-weight-400-hack-targets-two-liquidity-pools-span">Hack Targets Two Liquidity Pools</h2>
The breach, which occurred on December 1, impacted two of Clipper’s liquidity pools, amounting to 6% of the exchange’s total value locked (TVL). Clipper assured users that no other pools were affected and that the exploit has been resolved.
“There have been third-party claims suggesting a private key leak,” Clipper stated. “We can confirm that this is not the case and is inconsistent with the design and security architecture of Clipper.”
The vulnerability was linked to the ability to withdraw funds in the form of a single token, described as a “bundled swap + deposit/withdrawal transaction.” This feature has since been disabled as a precautionary measure.
The incident came to light after Chaofan Shou, co-founder of the security firm Fuzzland, <a href="https://x.com/shoucccc/status/1863105036328615958" rel="noopener noreferrer nofollow">suggested</a> on X that the hack could have resulted from an API vulnerability, enabling attackers to sign deposit and withdrawal requests fraudulently. Clipper dismissed these claims but acknowledged the need for a thorough investigation.
<h2 id="span-style-font-weight-400-protocol-takes-action-amid-rising-crypto-thefts-span">Protocol Takes Action Amid Rising Crypto Thefts</h2>
In the wake of the hack, Clipper has paused swaps and deposits while keeping withdrawals open, albeit with stricter conditions. Users can only withdraw funds in a mix of assets from the affected pools. The protocol is actively tracing the stolen funds and has extended an olive branch to the attacker, inviting them to initiate communication for potential negotiations.
This breach adds to the <a href="https://thecoinrise.com/crypto-losses-from-hacks-and-scams-drop-to-413-million-immunefi/" rel="noopener noreferrer nofollow">troubling tally of over $1.48 billion in crypto stolen globally in 2024</a>, according to a recent Immunefi report. While this figure marks a 15% decline compared to the same period last year, it underscores the persistent vulnerabilities plaguing the DeFi sector.
Shipyard Software Inc., the creator of Clipper, has yet to issue further statements regarding the incident. For Clipper and its users, the hack serves as a stark reminder of the importance of robust security protocols in safeguarding decentralized platforms.
The post <a href="https://thecoinrise.com/clipper-dex-hack-exposes-450000-vulnerability-team-rules-out-private-key-leak/" rel="noopener noreferrer nofollow">Clipper DEX Hack Exposes $450,000 Vulnerability, Team Rules Out Private Key Leak</a> appeared first on <a href="https://thecoinrise.com/" rel="noopener noreferrer nofollow">TheCoinrise.com</a>.

Clipper DEX Hack Exposes $450,000 Vulnerability, Team Rules Out Private Key Leak

Table of Contents

TheCoinrise Media

Other articles published on Dec 2, 2024

DMM Bitcoin exchange shuts down after a $321 million fraud incident

Solana (SOL) Crash Warning as Support Collapses, Eyes on $200

XRP Price Hits $2.50, Surpasses Solana’s Market Cap

Bitcoin Could Add $5 Trillion to Microsoft’s Value: Michael Saylor

Binance to Reward FLOKI and APE Holders with MONKY Tokens

Pump.fun Faces $22M Revenue Crash Amid Livestream Controversy

Join our free newsletter for daily crypto updates!