Tapioca 基金会向在“社会工程攻击”中窃取 470 万美元的攻击者提供 100 万美元的赏金

Tapioca 基金会向一名攻击者悬赏 100 万美元，该攻击者从其去中心化金融协议中窃取了 470 万美元。

decentralized finance (DeFi) protocol Tapioca has offered a $1 million bounty to an attacker who stole $4.7 million from the protocol in a “social engineering attack.”

去中心化金融 (DeFi) 协议 Tapioca 向一名通过“社会工程攻击”从该协议窃取 470 万美元的攻击者悬赏 100 万美元。

In an Oct. 20 onchain message to the attacker’s crypto wallet, Tapioca wrote:

Tapioca 在 10 月 20 日发给攻击者加密钱包的链上消息中写道：

“We would like to begin the conversation around offering you an attractive bounty settlement where you would walk away with funds that are fully legally yours, no strings attached.”

“我们希望围绕向您提供有吸引力的赏金和解开始对话，您将获得完全合法属于您的资金，不附加任何条件。”

The message adds that the bounty would be paid in Tether (USDT) — “significantly higher than the normal 10%” offered in bounties — in exchange for the attacker returning the remaining $3.7 million.

该消息补充说，赏金将以 Tether (USDT) 支付——“明显高于赏金中提供的正常 10%”——以换取攻击者返还剩余的 370 万美元。

According to an Oct. 18 X post by Tapioca, the attacker stole 591 Ether (ETH) and $2.8 million in USD Coin (USDC) in the “social engineering attack.”

根据 Tapioca 10 月 18 日的帖子，攻击者在“社会工程攻击”中窃取了 591 个以太币 (ETH) 和 280 万美元的美元硬币 (USDC)。

The attack compromised the ownership of the vesting contract for Tapioca’s Tapioca DAO Token (TAP) and the UDSO stablecoin, the post explained. The attacker was then able to claim and sell vested TAP and “added a minter to infinite mint USDO and drain” a liquidity pool for USDO and USDC.

该帖子解释说，这次攻击损害了 Tapioca 的 Tapioca DAO 代币（TAP）和 UDSO 稳定币的归属合约的所有权。然后，攻击者能够索取并出售既得的 TAP，并“添加一个铸币者来无限铸币 USDO，并耗尽”USDO 和 USDC 的流动性池。

Tapioca co-founder Matt Marino later stated in an Oct. 19 message on the project’s Discord that fellow pseudonymous co-founder “Rektora” was phished.

Tapioca 联合创始人马特·马里诺 (Matt Marino) 随后在 10 月 19 日在该项目 Discord 上发布的一条消息中表示，另一名化名联合创始人“Rektora”遭到了网络钓鱼。

“He downloaded something during an interview process and it replaced a transaction with a malicious one. This is how they gained access to the contracts,” Marino added.

“他在采访过程中下载了一些东西，并用恶意交易替换了一笔交易。这就是他们获得合同的方式。”马里诺补充道。

In a later Discord post on Oct. 19, Marino also claimed that they had “hacked the hacker and recovered 1,000 ETH,” which was the collateral backing the USDO stablecoin for a liquidity pool.

在随后于 10 月 19 日发布的 Discord 帖子中，Marino 还声称他们已经“破解了黑客并恢复了 1,000 ETH”，这是支持 USDO 稳定币流动性池的抵押品。

The attacker withdrew nearly 30 million TAP tokens from the vesting contract in the Oct. 18 attack, according to transactions in their wallet, which were then swapped for about $1.5 million in ETH before being converted into USDT and sent to the BNB Chain, where they still remain.

根据钱包中的交易，攻击者在 10 月 18 日的攻击中从归属合约中提取了近 3000 万个 TAP 代币，然后将这些代币兑换成约 150 万美元的 ETH，然后转换为 USDT 并发送到 BNB 链，在那里他们仍然存在。

The attack saw the TAP token lose almost all of its value. It is currently trading at 2 cents, having traded at around $1.40 prior to the attack, per CoinGecko.

此次攻击导致 TAP 代币几乎失去了所有价值。根据 CoinGecko 的数据，该币目前的交易价格为 2 美分，而攻击前的交易价格约为 1.40 美元。