2024 年 5 次最大的加密貨幣駭客攻擊 針對私鑰和智慧合約所有權

這不是什麼秘密。區塊鏈安全專家去年在屋頂上大聲疾呼：針對私鑰和智慧合約所有權的基礎設施攻擊將在 2024 年對加密項目造成重大損害。

Despite warnings from blockchain security experts, some companies failed to secure their private keys, leading to major crypto hacks in 2024. Here are the five biggest:

儘管區塊鏈安全專家發出警告，但一些公司未能保護其私鑰，導致 2024 年發生重大加密貨幣駭客攻擊。

1. DMM Bitcoin Lost $308 Million in May: Japanese crypto exchange DMM Bitcoin was hit hard, losing 4,502.9 Bitcoin (around $308 million) in May. While the details are still murky, security researchers believe North Korean hackers may have accessed the platform’s private keys. This is based on the similarities in laundering techniques used by the attackers, which are linked to the Lazarus Group, a notorious North Korean cybercrime syndicate. DMM Bitcoin failed to recover from the hack, closing earlier this month and transferring its assets to trading platform SVI VC Trade.

1. DMM Bitcoin 5 月損失 3.08 億美元：日本加密貨幣交易所 DMM Bitcoin 遭受重創，5 月損失 4,502.9 比特幣（約 3.08 億美元）。雖然細節仍不清楚，但安全研究人員認為北韓駭客可能已經存取了該平台的私鑰。這是基於攻擊者使用的洗錢技術的相似性，這些攻擊者與臭名昭著的北韓網路犯罪集團拉撒路集團有聯繫。 DMM Bitcoin 未能從駭客攻擊中恢復過來，於本月初關閉並將其資產轉移到交易平台 SVI VC Trade。

2. PlayDapp Hacked for $290 Million, but Averted災難: South Korean blockchain gaming app PlayDapp managed to avoid catastrophe despite suffering a massive hack in February. A hacker managed to hijack control of PlayDapp’s smart contract for minting tokens, creating 200 million PLA tokens. At the time, the tokens were valued at $26 million. PlayDapp quickly intervened, contacting exchanges to freeze the tokens and preventing the attacker from cashing out. However, the attacker persisted, minting 1.6 billion PLA tokens (around $264 million) a few days later, but they were unable to sell them. PlayDapp has since migrated to a new token contract.

2. PlayDapp 被駭客攻擊損失 2.9 億美元，但避免了災難：韓國區塊鏈遊戲應用程式 PlayDapp 儘管在 2 月遭受了大規模駭客攻擊，但仍設法避免了災難。一名駭客成功劫持了 PlayDapp 鑄造代幣智能合約的控制權，創造了 2 億個 PLA 代幣。當時，這些代幣的價值為 2,600 萬美元。 PlayDapp 迅速介入，聯繫交易所凍結代幣並阻止攻擊者兌現。然而，攻擊者堅持不懈，幾天後鑄造了 16 億枚 PLA 代幣（約 2.64 億美元），但無法出售。 PlayDapp 此後已移轉到新的代幣合約。

3. Hackers Stole $235 Million from WazirX in Multisig Wallet Breach: At first glance, India’s largest crypto exchange, WazirX, appeared to be a secure platform. It utilized a multisig wallet with four out of six signers, had address whitelisting configured to an offsite interface, and kept signing keys in a hardware wallet. Despite these measures, the platform lost nearly half of its assets in a single incident. In July, hackers breached one of the platform’s multisig wallets, stealing various cryptocurrencies, including Ether and the Shiba Inu memecoin, totaling $235 million. The attackers employed a complex attack vector, tricking WazirX wallet administrators into ceding access control to the bad actors, which they then used to bypass other security measures and syphon funds from the platform’s wallet. In November, police in India arrested a suspect allegedly connected to the hack.

3. 駭客在多重簽名錢包洩漏中從 WazirX 竊取了 2.35 億美元：乍一看，印度最大的加密貨幣交易所 WazirX 似乎是一個安全平台。它使用了六分之四簽名者的多重簽名錢包，將地址白名單配置到場外接口，並將簽名密鑰保存在硬體錢包中。儘管採取了這些措施，該平台還是在一次事件中損失了近一半的資產。 7 月，駭客攻破了該平台的一個多重簽名錢包，竊取了各種加密貨幣，包括以太幣和柴犬 memecoin，總計 2.35 億美元。攻擊者採用了複雜的攻擊媒介，欺騙 WazirX 錢包管理員將存取控制權交給不良行為者，然後他們利用這些攻擊繞過其他安全措施並從平台錢包中竊取資金。 11 月，印度警方逮捕了一名涉嫌與駭客攻擊有關的嫌疑人。

4. Radiant Capital Attacked Twice, Losing $62.5 Million: Cross-chain DeFi lending protocol Radiant Capital was hit by cybercriminals not once but twice in 2024, in January and October. In the first attack, an attacker manipulated the protocol’s smart contract to steal $4.5 million from Radiant Capital versions deployed on Arbitrum and BNB Chain. Later in October, the platform lost $58 million when hackers compromised the protocol developer’s private keys to steal funds. This second attack has been linked to North Korean cybercriminals. The attacker posed as a former team member and sent a malware-laced digital file to the project’s developer. The malware provided the hackers access to Radiant Capital’s computers, where the private keys were stored.

4. Radiant Capital 兩度遭受攻擊，損失 6,250 萬美元：跨鏈 DeFi 借貸協定 Radiant Capital 在 2024 年 1 月和 10 月兩次遭受網路犯罪分子的攻擊。在第一次攻擊中，攻擊者操縱該協定的智慧合約，從部署在 Arbitrum 和 BNB Chain 上的 Radiant Capital 版本中竊取了 450 萬美元。 10 月晚些時候，駭客洩漏了協議開發者的私鑰以竊取資金，該平台損失了 5800 萬美元。這第二次攻擊與北韓網路犯罪分子有關。攻擊者冒充前團隊成員，向專案開發人員發送了包含惡意軟體的數位檔案。該惡意軟體使駭客能夠存取儲存私鑰的 Radiant Capital 電腦。

5. Munchables Internal Hacker Stole $62.5 Million, Later Returned Keys: External actors are not the only threats to crypto projects; sometimes, the bad guys are within. That was the case in March for Muncha

5. Munchables 內部駭客竊取了 6,250 萬美元，後來歸還了金鑰：外部參與者並不是加密項目的唯一威脅；有時，壞人就在裡面。蒙查三月的情況就是如此