Verified blockchain security incidents with original evidence and historical event dates.
Historical events use their original event dates. Latest event dates first. Severity follows existing archive classifications.
Fountain (FTN) has an overflow vulnerability, the attacker performs an overflow attack by calling batchTransfers.
The attacker continued to attack the Lucky Nuts game contract nutsgambling and continues to profit from it. Eventually most of the stolen EOS was transferred to the Binance exchange account binancecleos.
The hacker mastered and modified FAST's token contract, deliberately created a vulnerability that can be used for multiple "additional" tokens for free.
"Transfer Error Prompt", as the game contract does not filter the false notifications provided by the game player.
The attacker snowredgreen attacked the LuckBet game contract luckbetadmin and transfers most of the acquired EOS to the Huobi exchange account huobideposit
The attacker binaryfunxxx attacked the EosDice's game contract bocai.game and transfers most of the acquired EOS to the Binance exchange account binancecleos.
Rollback transaction attack.
Big.game is suspected of being attacked by hacker eykkxszdrnnc. Big.game officially stated that the actual loss was about 8,000 EOS, and the balance of the dice prize pool has been transferred to a secure account.
The attacker (eykkxszdrnnc) launched an attack on the EOS MAX game contract (eosmaxiodice), an EOS quiz game, earning a total of 55,526.05 EOS. The game party has suspended the game operation at 6:40 am on the 19th, and issued an announcement saying that it was caused by a loophole in EOS Node, not a loophole in the game contract.
The attacker rolls back the transaction when placing a bet. From the time the bet is placed until the transaction is rolled back, the betting data will temporarily exist in the database of the current node; and Tobet queries the betting by polling the node database outside the contract. The lottery will be drawn outside the contract and the result will be passed to the lottery action; when the attacker keeps betting and rolls back the transaction, because the betting and Tobet polling use the same node, the Tobet lottery polling can query the database betting information for a short time and draw the lottery. . However, the attacker's bet was not successful, and the contract would continue to draw prizes for him, resulting in no capital arbitrage.
The attacker (panming12345) launched an attack on the EOS quiz game TRUSTBET game contract (trustbetgame), profiting a total of 11,501 EOS, and then transferred the EOS obtained from the attack to the Huobideposit account in two times. The attacker took advantage of the replay attack vulnerability. This is a form of attack that first appeared in the early days of the EOS DApp ecosystem. Due to the serious flaws in the random lottery algorithm designed by the developer, the attacker can use the contract vulnerabilities to draw the lottery repeatedly. Lower-level errors.
The attacker helookitiqas launched attacks on the EOS game kittyfishing, which launched a total of 91 attacks in two hours.
Vertcoin suffered a major attack in which hackers stole funds worth $100,000.
The attacker ha4tsojigyge launched 124 attacks on the Fastwin game contract fastwindice3.
Similar to the previous attack on EOS.WIN on November 11, multiple contract accounts were used to send transaction requests at the same time, and the front feint account was used to implement small bets. After ensuring a higher probability for the main attack account, increase the betting amount. And then get high bonuses.
Use multiple accounts to simultaneously send transaction requests for attack, so that the last attacker account gets the highest winning rate.
EOS Atidium's official account wwwatidiumio was abnormal. A total of 6 tokens including ATD tokens 337,759,004 were transferred to account b4jmqvvktgjx. The account then transferred 130 million ATD tokens to Newdex Exchange for cash, a total of 3,183.8564 EOS were profitable..
Hacker ybdzmtgouwxn launched an attack on nutsgambling, an EOS quiz game. In less than an hour, a total of 144 attacks were launched, and a total of 1,141.71 EOS was obtained. In order to prevent the flow of funds from being tracked, the hacker used multiple sub-accounts to sequentially transfer the acquired assets to the account kcbtvwtxeabc, which has not been withdrawn to the exchange yet.
American Bitcoin payment processor BitPay stated that the company's Copay wallet was attacked by hackers. Bitpay announced on Monday that it learned of this issue from a report on Copay GitHub. The report showed that third-party JavaScript libraries used by these applications were modified and malicious code was loaded. The malware was inserted into versions 5.0.2 to 5.1.0 of the Copay and BitPay wallet applications and may be used to obtain private keys for stealing Bitcoin and Bitcoin Cash. According to reports, the attack appeared to be carried out by a developer named Right9ctrl, who took over the maintenance of the NodeJS library from the left manager. About three months ago, when Right9ctrl was granted access to the repository, he inserted malware at this time.
The attacker (kuybupeykieh) launched an attack on the EOS quiz game contract (vegasgame111), making a total of hundreds of EOS. The data on the tracking chain found that, in order to prevent the flow of funds from being tracked, the hacker used dozens of operations to create sub-accounts. In order to transfer the acquired assets sequentially, the attacker used the "fake EOS" vulnerability to carry out the attack.