Ethereum News Daily TheBitTimes.com

Lazarus members posed as engineers and fooled exchange employees into downloading difficult-to-detect malware. Lazarus Group used a new form of malware in an attempt to compromise a crypto exchange , according to an October 31 report from Elastic Security Labs. Elastic has named the new malware “KANDYKORN” and the loader program that loads it into memory “SUGARLOAD,” as the loader file has a novel “.sld” extension in its name. Elastic did not name the exchange that was targeted. Crypto exchanges have suffered a rash of private-key hacks in 2023, most of which have been traced to the North Korean cybercrime enterprise, Lazarus Group. KANDYKORN infection process. Source: Elastic Security Labs. According to Elastic, the attack began when Lazarus members posed as blockchain engineers and targeted engineers from the unnamed crypto exchange. The attackers made contact on Discord, claiming they had designed a profitable arbitrage bot that could profit from discrepancies between prices ...

CyberConnect co-founder Ryan Li believes that creators who want their content to live forever will ditch Web2 social media platforms for Web3 alternatives. The Web3 industry continues its mission to disrupt the World Wide Web, and social media is one of its primary targets. In the 34th episode of Cointelegraph’s Hashing It Out , host Elisha Owusu Akyaw interviews Ryan Li, co-founder of CyberConnect, about the concept of decentralized social media.  Li kicks off the episode by explaining the rationale behind creating social media platforms running on blockchain. Li points out that Web3 social media platforms give content creators the confidence that they won’t be abandoned when the platform gets bigger or shifts its focus to ad revenue, unlike traditional platforms. This feature is built on top of a decentralized financial system, and the speculative nature of the space creates a strong case for SocialFi. Li also highlights updates in recent years that have shone a spotlight on decent...

Hackers have reportedly exploited a weakness in popular crypto wallet tool Libbitcoin Explorer that has allowed them to steal funds from multiple blockchains. According to software security expert Distrust, which led the investigation, the ‘Milk Sad’ issue (so named because those were the first two words in the seed phrase of the broken key generation process), suffers from a “flawed seed subcommand for the generation of new wallet private key entropy.” As a result, it produces insecure output. “Think of this as securing your online bank account with a password manager that creates a long random password, but it often creates the same passwords for every user. Malicious people have figured this out and drained funds on any account they can find,” investigators say. Distrust warns that the effective security is reduced to a point where a powerful gaming PC can brute-force the seeds in less than one day . Researchers didn’t confirm exactly which wallet s had been affected by the Lib...

The vulnerability dubbed “HamsterWheel” traps nodes in an endless loop similar to hamsters jogging on a wheel. Blockchain security firm CertiK has received a bounty of $500,000 from the Sui network after flagging a threat that had the potential to disrupt Sui's entire layer-1 blockchain. In an announcement sent to Cointelegraph, the CertiK team highlighted that the vulnerability dubbed "HamsterWheel" was different from traditional attacks which focus on shutting down blockchain s by crashing nodes. This attack traps nodes, letting them perform operations without processing new transactions, similar to hamsters jogging on a wheel. The attack has the capability to cripple networks and make them unable to operate. The security firm discovered the vulnerability and reported it to Sui ahead of its mainnet launch. Responding to the security threat, the Sui network implemented fixes to prevent the potential damages that an attack could inflict on the blockchain. To appreciate ...

Ledger’s “Recover” service may be concerning, but some crypto industry participants think the feature may onboard new users while helping crypto natives. Hardware crypto wallet firm Ledger has faced harsh criticism from the crypto community after announcing its “Recover” service, which is an optional paid feature that will eventually allow users to back up and restore their private seed phrase. Due to concerns expressed about the security elements of Ledger Recover, the hardware wallet manufacturer decided to postpone the launch of its service. On May 23, Charles Guillemet, chief technology officer of Ledger, explained in a Twitter thread that Ledger will “accelerate our open-sourcing roadmap to bring more verifiability to everything we do.” Ledger’s mission is, and will always be, to provide our users with the right tools to own their digital value securely. We have decided to accelerate our open-sourcing roadmap to bring more verifiability to everything we do. A thread pic.twitter....

A total of 517,000 token votes favored the proposal, with none opposing it. The governance tokenholders of Tornado Cash will soon regain control over the protocol’s operations, thanks to an unexpected proposal put forward by the attacker. This development allows the community to regain authority and steer the protocol toward recovery and improved security measures. On May 26, the proposal to restore control to the original governance tokenholders of Tornado Cash passed successfully. A total of 517,000 token votes favored the proposal , with none opposing it. This resolution brings a swift conclusion to a governance takeover that, fortunately, did not impact the protocol itself, but did lead to the theft of specific governance tokens. A screenshot showing the voting results. Source: Tornado Cash By successfully orchestrating a takeover of the protocol’s governance system, the attacker maneuvered a malicious proposal that granted them 1.2 million votes. Leveraging this significant...

Ether can simultaneously be a security and commodity under the regulatory scope of the SEC and CFTC, former CFTC commissioner Dan Berkovitz claimed. Ethereum’s native Ether (ETH) token may be both a commodity and a security, the former commissioner of the United States Commodities Futures Trading Commission has claimed. Speaking on a May 23 episode of Laura Shin’s Unchained podcast, Dan Berkovitz, who is also the former general counsel at the Securities and Exchange Commission, said that it’s legally possible for ETH to fall under the jurisdiction of both regulatory agencies. Laura Shin, Dan Berkovitz and Colin Lloyd speaking on the Unchained podcast. Source: YouTube The ongoing confusion over Ether’s legal status stems in large part from conflicting statements from the CFTC and the SEC. Over the course of the last six months, the CFTC has repeatedly called Ether, along with a number of other cryptocurrencies, a commodity. Meanwhile, the Gary Gensler-led SEC hasn’t explicitly provide...

The market cap of USDC, a stablecoin issued by Circle, has reduced nearly by half over the past six months following a regulatory crackdown and banking crisis. Circle CEO Jeremy Allaire says that a cryptocurrency crackdown by the United States regulators has been a major factor behind the declining market capitalization of its stablecoin, USD Coin (USDC). Circle chief’s comments on the U.S. crackdown come amid heavy regulatory scrutiny following the collapse of the FTX exchange, a banking crisis and USDC’s momentary depegging. During an interview with Bloomberg TV, Allaire noted that there is a “huge amount of concern globally about the U.S. banking system,” and the “regulatory environment in the U.S..” USDC depegged in March, a direct result of the U.S. banking crisis. Circle’s $3.3 billion worth of USDC reserves was stuck with Silicon Valley Bank, which was one of the three crypto-friendly banks shut down by regulators. At the time, Circle had assured its customers that it had the b...

The latest version of ChatGPT is able to identify Ethereum smart contract vulnerabilities and exploits - but will it replace developers in the future? The newest version of ChatGPT has caused a stir online, scoring high marks for SAT tests and highlighting vulnerabilities and exploits in Ethereum smart contracts. GPT-4 is the latest version of the highly influential artificial intelligence (AI) language model, boasting ‘human-level performance on various professional and academic benchmarks,’ according to its developer OpenAI. Aside from outstanding scores on a range of various professional and academic benchmarks, GPT-4 has also demonstrated the ability to review Ethereum smart contracts, highlighting vulnerabilities and even suggesting potential ways to exploit the code. I dumped a live Ethereum contract into GPT-4. In an instant, it highlighted a number of Security vulnerabilities and pointed out surface areas where the contract could be exploited. It then verified a specific way I...