网络钓鱼诈骗使 DeFi 用户损失 3500 万美元

去中心化金融（DeFi）领域正在提供一种无需中介的新交易方式。但这种做法也带来了严重的风险

A recent phishing attack cost one user $35 million, showcasing the vulnerabilities in the DeFi ecosystem.

最近的一次网络钓鱼攻击使一名用户损失了 3500 万美元，这暴露了 DeFi 生态系统中的漏洞。

On Friday, October 11, on-chain data revealed one of the largest losses in DeFi due to phishing scams. After approving a fraudulent permit signature, a DeFi user lost 15,079 fwDETH tokens, valued at $35 million.

10 月 11 日星期五，链上数据揭示了 DeFi 中因网络钓鱼诈骗造成的最大损失之一。在批准欺诈性许可签名后，一名 DeFi 用户丢失了 15,079 个 fwDETH 代币，价值 3500 万美元。

? 5 hours ago, someone lost 15,079 fwDETH($35M) after signing a "permit" phishing signature.

? 5 小时前，有人在签署“许可”网络钓鱼签名后损失了 15,079 fwDETH（3500 万美元）。

According to online investigators, the phishing attack utilized the permit signature function. This feature, designed to facilitate token transfers, also enables attackers to swiftly drain user wallets.

据网上调查人员称，钓鱼攻击利用了许可证签名功能。这一功能旨在促进代币转移，也使攻击者能够迅速耗尽用户钱包。

TL;DR: An unknown suspicious address obtained tens of thousands of fwdETH through the permit method and sold them, causing the price of dETH to plummet rapidly, leading to attacks on protocols like PAC Finance and Orbit Finance.

TL;DR：一个未知的可疑地址通过许可方式获得了数万枚 fwdETH 并出售，导致 dETH 价格迅速暴跌，导致 PAC Finance 和 Orbit Finance 等协议受到攻击。

https://t.co/FwsGhSfs0q

https://t.co/FwsGhSfs0q

">@RingProtocol…

">@RingProtocol...

The stolen tokens were then quickly sold on decentralized exchanges. The substantial volume and selling pressure even resulted in a sharp decline in dETH price on DeFi platforms PAC Finance and Orbit Finance.

被盗的代币随后很快在去中心化交易所出售。巨大的交易量和抛售压力甚至导致 DeFi 平台 PAC Finance 和 Orbit Finance 上的 dETH 价格大幅下跌。

To safeguard against phishing scams, users are advised to adhere to several crucial practices:

为了防范网络钓鱼诈骗，建议用户遵守以下几项重要做法：

Double-Check Permissions: Prior to signing any signature approvals, thoroughly review the transaction details. Phishing attacks capitalize on users' tendency to trust signature approvals posted online. In DeFi, the stakes of these approvals are particularly high.

仔细检查权限：在签署任何签名批准之前，请彻底检查交易详细信息。网络钓鱼攻击利用了用户信任在线发布的签名批准的倾向。在 DeFi 中，这些批准的风险特别高。

Use Reputable Wallets: Many wallets integrate built-in security features to help prevent common scams and exploits.

使用信誉良好的钱包：许多钱包集成了内置安全功能，以帮助防止常见的诈骗和漏洞。

Enable Multi-Factor Authentication (MFA): MFA adds an extra layer of protection to transactions. When enabled, even if an attacker manages to trick a user into signing, they still need to clear additional security checks.

启用多重身份验证 (MFA)：MFA 为事务添加了额外的保护层。启用后，即使攻击者设法诱骗用户签名，他们仍然需要通过额外的安全检查。

Safe Browsing and Email Use: Refrain from responding to any unsolicited emails, especially those urging users to click on links. Always verify the sender's email to identify any attempts to impersonate legitimate entities.

安全浏览和电子邮件使用：不要回复任何未经请求的电子邮件，尤其是那些敦促用户单击链接的电子邮件。请务必验证发件人的电子邮件，以识别任何冒充合法实体的企图。