Tapioca 基金会在 TAP 代币和 USDO 稳定币的黑客目标兑现合同中损失了 470 万美元

Tapioca Foundation 于 10 月 20 日在链上消息中直接向攻击者披露了该漏洞。该消息包含有吸引力的报价

On October 18, a phishing attack targeting a co-founder of the Tapioca Foundation resulted in the theft of 591 ETH and $2.8 million in USD Coin (USDC) from the Tapioca DAO Token (TAP) and USDO stablecoin vesting contract. The attacker was able to gain access to the vested TAP tokens and used them to mint an infinite amount of USDO, which was then used to drain liquidity pools containing USDO and USDC.

10 月 18 日，针对 Tapioca 基金会联合创始人的网络钓鱼攻击导致 Tapioca DAO 代币（TAP）和 USDO 稳定币兑现合约中的 591 ETH 和 280 万美元美元代币（USDC）被盗。攻击者能够访问既定的 TAP 代币，并使用它们铸造无限量的 USDO，然后将其用于耗尽包含 USDO 和 USDC 的流动性池。

The Tapioca Foundation revealed the breach in an on-chain message on October 20, directly addressing the attacker. The message included an appealing offer: “We would like to offer you an attractive bounty settlement where you would walk away with funds that are fully legally yours, no strings attached.” The foundation proposed a $1 million bounty in Tether (USDT), which is significantly higher than the typical 10% bounty, in exchange for the attacker returning the remaining $3.7 million.

Tapioca 基金会于 10 月 20 日在链上消息中直接向攻击者披露了该漏洞。该消息包括一个有吸引力的提议：“我们愿意为您提供有吸引力的赏金和解，您将获得完全合法属于您的资金，不附加任何条件。”该基金会提议以 Tether (USDT) 形式悬赏 100 万美元，这明显高于典型的 10% 悬赏金额，以换取攻击者返还剩余的 370 万美元。

According to Matt Marino, co-founder of Tapioca, the attack occurred during a job interview, where a co-founder, known pseudonymously as “Rektora,” fell victim to a phishing attack. Marino stated that Rektora unknowingly downloaded malicious software, allowing attackers to alter transactions and take control of key contracts.

Tapioca 联合创始人马特·马里诺 (Matt Marino) 表示，此次攻击发生在一次求职面试期间，一位化名“Rektora”的联合创始人成为网络钓鱼攻击的受害者。 Marino 表示，Rektora 在不知情的情况下下载了恶意软件，使攻击者能够改变交易并控制关键合约。

However, the Tapioca team managed to partially recover the stolen assets. Marino later announced that Tapioca had “hacked the hacker” and retrieved 1,000 ETH, valued at over $2.7 million, which had been used as collateral for the USDO stablecoin in a liquidity pool.

然而，Tapioca 团队成功追回了部分被盗资产。 Marino 随后宣布，Tapioca 已经“破解了黑客”并取回了 1,000 个 ETH，价值超过 270 万美元，这些资金已被用作流动性池中 USDO 稳定币的抵押品。

Following the attack, nearly 30 million TAP tokens were withdrawn from the vesting contract and swapped for approximately $1.5 million in ETH. The attacker then converted the ETH into USDT and moved it to the BNB Chain, where the funds remain, according to on-chain records.

攻击发生后，近 3000 万个 TAP 代币从归属合约中被撤回，并兑换成约 150 万美元的 ETH。然后，攻击者将 ETH 转换为 USDT，并将其转移到 BNB 链上，根据链上记录，资金仍留在那里。

The TAP token, which was trading at around $1.40 before the attack, has since seen a drastic decrease in value, now hovering at just $0.015.

TAP 代币在攻击前的交易价格约为 1.40 美元，此后其价值急剧下跌，目前徘徊在 0.015 美元左右。

The Tapioca Foundation hacking incident raises questions about the security of decentralized finance (DeFi) protocols and the broader crypto industry. In the past four months alone, the crypto community has faced multiple frauds and hacks, highlighting the need for increased vigilance and robust security measures to protect digital assets.

Tapioca 基金会黑客事件引发了人们对去中心化金融（DeFi）协议和更广泛的加密行业的安全性的质疑。仅在过去的四个月里，加密货币社区就面临多起欺诈和黑客攻击，凸显出需要提高警惕并采取强有力的安全措施来保护数字资产。