網路釣魚詐騙使 DeFi 用戶損失 3500 萬美元

去中心化金融（DeFi）領域正在提供一種無需中介的新交易方式。但這種做法也帶來了嚴重的風險

A recent phishing attack cost one user $35 million, showcasing the vulnerabilities in the DeFi ecosystem.

最近的一次網路釣魚攻擊使一名用戶損失了 3500 萬美元，這暴露了 DeFi 生態系統中的漏洞。

On Friday, October 11, on-chain data revealed one of the largest losses in DeFi due to phishing scams. After approving a fraudulent permit signature, a DeFi user lost 15,079 fwDETH tokens, valued at $35 million.

10 月 11 日星期五，鏈上數據揭示了 DeFi 中因網路釣魚詐騙造成的最大損失之一。在批准了欺詐性許可證簽名後，一名 DeFi 用戶丟失了 15,079 個 fwDETH 代幣，價值 3500 萬美元。

? 5 hours ago, someone lost 15,079 fwDETH($35M) after signing a "permit" phishing signature.

? 5 小時前，有人在簽署「許可」網路釣魚簽名後損失了 15,079 fwDETH（3500 萬美元）。

According to online investigators, the phishing attack utilized the permit signature function. This feature, designed to facilitate token transfers, also enables attackers to swiftly drain user wallets.

據網路調查人員稱，釣魚攻擊利用了許可證簽名功能。這項功能旨在促進代幣轉移，也使攻擊者能夠迅速耗盡用戶錢包。

TL;DR: An unknown suspicious address obtained tens of thousands of fwdETH through the permit method and sold them, causing the price of dETH to plummet rapidly, leading to attacks on protocols like PAC Finance and Orbit Finance.

TL;DR：一個未知的可疑地址通過許可方式獲得了數萬枚 fwdETH 並出售，導致 dETH 價格迅速暴跌，導致 PAC Finance 和 Orbit Finance 等協議受到攻擊。

https://t.co/FwsGhSfs0q

https://t.co/FwsGhSfs0q

">@RingProtocol…

">@RingProtocol...

The stolen tokens were then quickly sold on decentralized exchanges. The substantial volume and selling pressure even resulted in a sharp decline in dETH price on DeFi platforms PAC Finance and Orbit Finance.

被盜的代幣隨後很快就會在去中心化交易所出售。巨大的交易量和拋售壓力甚至導致 DeFi 平台 PAC Finance 和 Orbit Finance 上的 dETH 價格大幅下跌。

To safeguard against phishing scams, users are advised to adhere to several crucial practices:

為了防範網路釣魚詐騙，建議使用者遵守以下幾項重要做法：

Double-Check Permissions: Prior to signing any signature approvals, thoroughly review the transaction details. Phishing attacks capitalize on users' tendency to trust signature approvals posted online. In DeFi, the stakes of these approvals are particularly high.

仔細檢查權限：在簽署任何簽名批准之前，請徹底檢查交易詳細資訊。網路釣魚攻擊利用了用戶信任在線上發布的簽名批准的傾向。在 DeFi 中，這些核准的風險特別高。

Use Reputable Wallets: Many wallets integrate built-in security features to help prevent common scams and exploits.

使用信譽良好的錢包：許多錢包整合了內建安全功能，以幫助防止常見的詐騙和漏洞。

Enable Multi-Factor Authentication (MFA): MFA adds an extra layer of protection to transactions. When enabled, even if an attacker manages to trick a user into signing, they still need to clear additional security checks.

啟用多重身份驗證 (MFA)：MFA 為交易增加了額外的保護層。啟用後，即使攻擊者設法誘騙用戶簽名，他們仍然需要通過額外的安全檢查。

Safe Browsing and Email Use: Refrain from responding to any unsolicited emails, especially those urging users to click on links. Always verify the sender's email to identify any attempts to impersonate legitimate entities.

安全瀏覽和電子郵件使用：不要回覆任何未經請求的電子郵件，尤其是那些敦促用戶點擊連結的電子郵件。請務必驗證寄件者的電子郵件，以識別任何冒充合法實體的企圖。