Delta Prime DeFi 平台遭駭客攻擊損失 600 萬美元，突顯可升級合約的風險

Delta Prime 是在 Arbitrum 網路上運行的 DeFi 平台，已成為駭客利用漏洞進行重大網路攻擊的受害者

A DeFi platform on the Arbitrum network, Delta Prime, has fallen victim to a major cyberattack. According to on-chain data, a hacker exploited a vulnerability in the platform’s token minting system, managing to drain over $6 million from its liquidity pools.

Arbitrum 網路上的 DeFi 平台 Delta Prime 已成為重大網路攻擊的受害者。根據鏈上數據，一名駭客利用該平台代幣鑄造系統的漏洞，成功從其流動性池中抽走超過 600 萬美元。

The breach began when the attacker gained control of Delta Prime’s admin account, likely by stealing a developer’s private key. With access to the admin wallet, the attacker used the platform’s upgrade function to modify several liquidity pool contracts. These contracts were linked to proxy addresses, a mechanism designed to allow developers to implement software upgrades.

當攻擊者可能透過竊取開發人員的私鑰控制 Delta Prime 的管理員帳戶時，漏洞就開始了。透過存取管理員錢包，攻擊者利用平台的升級功能修改了多個流動性池合約。這些合約連結到代理地址，這是一種旨在允許開發人員實現軟體升級的機制。

However, instead of upgrading the software, the attacker pointed the contracts to malicious versions that allowed them to mint arbitrarily large numbers of tokens. According to blockchain data from block explorer Arbiscan, the hacker initially minted over 115 duovigintillion Delta Prime USD (DPUSDC) tokens. In scientific notation, this astronomical figure is represented as 1.1*10^69.

然而，攻擊者並沒有升級軟體，而是將合約指向惡意版本，從而允許他們鑄造任意數量的代幣。根據區塊瀏覽器 Arbiscan 的區塊鏈數據，駭客最初鑄造了超過 115 個 duovigintillion Delta Prime USD (DPUSDC) 代幣。用科學計數法來說，這個天文數字表示為1.1*10^69。

DPUSDC is a deposit receipt token for the USDC stablecoin, intended to be redeemable at a 1:1 ratio. Despite minting a massive amount of DPUSDC, the hacker only went on to redeem $2.4 million worth of USDC.

DPUSDC 是 USDC 穩定幣的存款收據代幣，可以 1:1 的比例兌換。儘管鑄造了大量的 DPUSDC，但駭客僅贖回了價值 240 萬美元的 USDC。

The same exploit was applied to other deposit receipt tokens, including Delta Prime Wrapped Bitcoin (DPBTCb), Delta Prime Wrapped Ether (DPWETH), and Delta Prime Arbitrum (DPARB). The attacker minted massive quantities of these tokens and redeemed a small fraction, ultimately stealing over $6 million in assets, including BTC, ETH, ARBI, and USDC.

同樣的漏洞也適用於其他存款收據代幣，包括 Delta Prime Wrapped Bitcoin (DPBTCb)、Delta Prime Wrapped Ether (DPWETH) 和 Delta Prime Arbitrum (DPARB)。攻擊者鑄造了大量這些代幣並贖回了一小部分，最終竊取了超過 600 萬美元的資產，包括 BTC、ETH、ARBI 和 USDC。

Cyvers, an on-chain security platform, was one of the first to report the attack, warning that the losses initially stood at $4.5 million but quickly escalated as the hacker continued draining pools.

鏈上安全平台 Cyvers 是最早報告攻擊的平台之一，並警告損失最初為 450 萬美元，但隨著駭客繼續耗盡資金池，損失迅速擴大。

ALERT

警報

@DeltaPrimeDefi has faced a security incident on their admin keys. Attacker had control on the private key of 0x40e4ff9e018462ce71fa34abdfa27b8c5e2b1afbthen he upgraded the proxy!

@DeltaPrimeDefi 的管理金鑰面臨安全事件。攻擊者控制了0x40e4ff9e018462ce71fa34abdfa27b8c5e2b1afb的私鑰，然後升級了代理程式！

So far $5.93M has been drained!

到目前為止$593萬已經被耗盡！

Want to keep your company off our alerts radar? Learn… https://t.co/yOmNZJyp5l pic.twitter.com/lztFvXVmfI

想讓您的公司遠離我們的警報雷達嗎？學習… https://t.co/yOmNZJyp5l pic.twitter.com/lztFvXVmfI

— Cyvers Alerts (@CyversAlerts) September 16, 2024

- Cyvers Alerts (@CyversAlerts) 2024 年 9 月 16 日

Later, blockchain security specialist Chaofan Shou confirmed that the total theft amounted to approximately $6 million.

隨後，區塊鏈安全專家手超凡確認，竊盜總額約600萬美元。

Delta Prime @DeltaPrimeDefi admin private key leaked. All pools are drained. $7M loss already. Withdraw ASAP!https://t.co/uNn5nZoHp3 pic.twitter.com/se3RebRjpX

Delta Prime @DeltaPrimeDefi 管理員私鑰外洩。所有水池均已排乾。已經損失了 700 萬美元。盡快撤回！

— Chaofan Shou (@shoucccc) September 16, 2024

— Chaofan Shou (@shoucccc) September 16, 2024

This incident highlights the risks associated with upgradable contracts in the DeFi ecosystem. While upgradable contracts allow developers to fix bugs post-deployment, they introduce a centralization risk if an admin account is compromised, as seen in the Delta Prime hack.

這一事件凸顯了 DeFi 生態系統中與可升級合約相關的風險。雖然可升級合約允許開發人員在部署後修復錯誤，但如果管理員帳戶受到威脅，它們就會帶來中心化風險，正如 Delta Prime 駭客事件中所見。

The attack on Delta Prime is part of a growing trend of high-profile DeFi breaches, with experts warning that future targets could include even larger institutions, such as Bitcoin exchange-traded funds, which hold billions in digital assets.

對 Delta Prime 的攻擊是備受矚目的 DeFi 漏洞日益增長的趨勢的一部分，專家警告稱，未來的目標可能包括更大的機構，例如持有數十億數位資產的比特幣交易所交易基金。