Story image

Hackers steal $32m of ethereum cryptocurrency – expert commentary and advice

22 Jul 2017

In the second heist this week, hackers have stolen around 150,000 ethers, worth roughly US$32 million.

The security alert was issued by smart contract coding company Parity with the data confirmed by Etherscan.io.

According to the startup, the breach is a result of a bug in a specific multi-sig contract known as wallet.sol.

In its public messages, Parity graded the severity of the bug as ‘critical’, imploring any user with funds in a multi-sig wallet to transfer them to a secure address as soon as possible.

Senior Threat Research Analyst at Webroot, Tyler Moffit says this latest incident has serious ramifications around the world.

“In fact, ETH price has actually taken a dip, and some of this is likely due to the uncertainty around this breach,” says Moffit.

“Hackers exploited a vulnerability in multi-sig wallets from Parity – drastically different from the ICO CoinDash hack that happened earlier this week.”

The ICO CoinDash hack that Moffit refers to was an attack that successfully managed to steal $10 million in an ICO earlier this week, however that pales to the more recent attack of $32 million.

While the hackers were making the transactions, there was also an unknown white hat group that actually used the same exploit to drain ether from other Parity multi-sig wallets into different wallets to save them. The white hat group was able to save over 377,000 ETH which is about $75 million,” says Moffit.

“The current advice for businesses using Parity’s multi-sig wallets to move their funds to other wallets ASAP. If your accounts have been drained, then I recommend also checking the white hat address as it may have been saved.”

Moffit says the key takeaway from this hack – and obviously the many others in the past and inevitably the future – is that we’re still exploring the blockchain space, which makes wallet security more important than ever.

“As a threat researcher, I personally recommend hardware or native wallets (desktop wallets); they are the most secure, as you are in control of any transaction,” Moffit says.

“Do NOT store lots of currency in exchanges that control your private address. Only use them to make trades then back out to safe addresses.”

Secureworks Magic Quadrant Leader for Security Services
This is the 11th time Secureworks has been positioned as a Leader in the Gartner Magic Quadrant for Managed Security Services, Worldwide.
Google puts Huawei on the Android naughty list
Google has apparently suspended Huawei’s licence to use the full Android platform, according to media reports.
Using data science to improve threat prevention
With a large amount of good quality data and strong algorithms, companies can develop highly effective protective measures.
General staff don’t get tech jargon - expert says time to ditch it
There's a serious gap between IT pros and general staff, and this expert says it's on the people in IT to bridge it.
ZombieLoad: Another batch of flaws affect Intel chips
“This flaw can be weaponised in highly targeted attacks that would normally require system-wide privileges or a complete subversion of the operating system."
Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.