Ethereum – a platform for creating decentralized online services based on the blockbuster. Exchange units Ethereum is usually called "ether", and this crypto currency has the potential not less than that of Bitocoin, and maybe even more. Despite some problems in the process of platform formation, Ethereum is becoming more popular day by day. And this popularity attracts not only well-meaning users, but also intruders.
Some of them manage to make a good profit. And cybercriminals do not necessarily have to use zero-day vulnerabilities, it is ideal to know the principles of the operation of crypto-currency protocols and other things. You can simply take and change the address of the purse to which money is sent during Initial Coin Offering (the primary location of the tokens), or, abbreviatedly, ICO, on the victim's website. Coindash said that this was done by intruders with its own site, so that investors of this organization after the start of ICO sent money to the purse of cybercriminals one by one.
The injured company is a block-start-up. After the problem became known, Coindash management had to stop ICO, telling investors about hacking its site. While the wrong wallet was shown on the company's web site, the cybercriminals could get more than $ 7 million on their accounts. The message about the cracking was sent by the CoinDash management to all investors, also on Twitter.
In just a few minutes 43,000 broadcasts were translated. At the rate for July 17, this is just over $ 7 million. The most interesting is that even when the Ethereum administration marked this purse as a fake (FAKE_CoinDash), investors continued to send money to it. As a result, the attackers collected more than $ 7.4 million. So far, the incident has been investigated, but it became clear that nothing good would end there. Already, the company is accused that hacking is not hacking at all, but purposeful actions of its leadership aimed at illegal enrichment. A number of affected network users announced their intention to go to court.
The main problem, in general, is the lack of special security measures during the ICO. Place a text string, on the correctness of the content of which depends on whether the right address will go to millions of US dollars – not the best solution. Just a few minutes was enough for the attackers to get the bulk of the money. Initially, it was assumed that the ICO of Coindash will go smoothly and without any problems. While it is not known exactly how the attackers changed the text line on the site, but it was hardly a super complicated way – the hackers know their business.
"All we know is that the attacker changed the address right after the start of the ICO," says Ram Eivissar, marketing director of Coindash. As mentioned above, in the hacking, some users suspect the company's management, not hackers. This topic is now actively discussed at Reddit, laying out more and more arguments in favor of this point of view. Even those users who do not consider the company guilty of deception, argues that it must return the money. "I want to get my money. This is your site, and you are to blame for not taking proper care of your security, "said one of the investors who sent the money to a fake wallet. Another dissatisfied wrote the following: "It's too late, I've already invested! 31 thousand broadcasts went to the address! You guys better get my money back. "
This hacking is currently one of the largest for companies dealing with Ethereum. Even more large amount was lost last year, DAO investment fund. Then it was about as much as $ 50 million. This led to the fact that the developers of crypto currency decided to even divide the platform into two parts to restore the lost funds. But most of the users of the system considered that this was an unjustified risk and the administration decided not to make any fundamental decisions.
Despite all the difficulties, the positions of the "ether" are strong
CoinDash has already stated that it is going to return funds to its depositors: "All CoinDash investors will get their tokens back. We are working to resolve the situation. " The statement that the funds depositors will be returned is done. But only in this case, no one told how it is planned to do. Those funds that went to the wallets of intruders are unlikely to be repaid, so either the company will have to pay out of its fairly thin purse, or no one will seriously repay the funds.