Story image

Hackers steal $32m of ethereum cryptocurrency – expert commentary and advice

22 Jul 2017

In the second heist this week, hackers have stolen around 150,000 ethers, worth roughly US$32 million.

The security alert was issued by smart contract coding company Parity with the data confirmed by Etherscan.io.

According to the startup, the breach is a result of a bug in a specific multi-sig contract known as wallet.sol.

In its public messages, Parity graded the severity of the bug as ‘critical’, imploring any user with funds in a multi-sig wallet to transfer them to a secure address as soon as possible.

Senior Threat Research Analyst at Webroot, Tyler Moffit says this latest incident has serious ramifications around the world.

“In fact, ETH price has actually taken a dip, and some of this is likely due to the uncertainty around this breach,” says Moffit.

“Hackers exploited a vulnerability in multi-sig wallets from Parity – drastically different from the ICO CoinDash hack that happened earlier this week.”

The ICO CoinDash hack that Moffit refers to was an attack that successfully managed to steal $10 million in an ICO earlier this week, however that pales to the more recent attack of $32 million.

While the hackers were making the transactions, there was also an unknown white hat group that actually used the same exploit to drain ether from other Parity multi-sig wallets into different wallets to save them. The white hat group was able to save over 377,000 ETH which is about $75 million,” says Moffit.

“The current advice for businesses using Parity’s multi-sig wallets to move their funds to other wallets ASAP. If your accounts have been drained, then I recommend also checking the white hat address as it may have been saved.”

Moffit says the key takeaway from this hack – and obviously the many others in the past and inevitably the future – is that we’re still exploring the blockchain space, which makes wallet security more important than ever.

“As a threat researcher, I personally recommend hardware or native wallets (desktop wallets); they are the most secure, as you are in control of any transaction,” Moffit says.

“Do NOT store lots of currency in exchanges that control your private address. Only use them to make trades then back out to safe addresses.”

Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.
VoiP new-comer upgraded and ready to take on NZ
UFONE is an Auckland-based VoIP provider that has just completed a massive upgrade of its back-end and is ready to take on the market.
Online attackers abusing Kiwis' generosity in wake of Chch tragedy
It doesn’t take some people long to abuse people’s kindness and generosity in a time of mourning.
Apple launches revamped iPad Air & iPad mini
Apple loves tinkering with its existing product lines and coming up with new ways to make things more powerful – and both the iPad Air and iPad mini seem to be no exception.
IntegrationWorks continues expansion with new Brisbane office
The company’s new office space at the Riverside Centre overlooks the Brisbane River and Storey Bridge.
Emerging tech helps savvy SMB’s succeed
A CompTIA report shows SMBs are taking on the challenge of emerging technologies to reach their business goals.
Tech community rocked by deaths of Atta Elayyan and Syed Jahandad Ali
Both men were among the 50 killed in the shooting in Christchurch last Friday when a gunman opened fire at two mosques.