Summary:
On the 4th of September 2023, Stake, a betting platform, was hacked on Ethereum, Binance and Polygon chains. Around $41.3 Million was transferred to different accounts.
About Project:
Stake.com is a crypto gambling application with casino and sports betting platforms for Bitcoin and other cryptocurrencies. To learn more about them, check out their website.
Vulnerability Analysis & Impact
On-Chain Details
Attacker Address: 0x3130662aece32f05753d00a7b95c0444150bcd3c
Victim Contract: 0x974caa59e49682cda0ad2bbe82983419a2ecc400
Attack Transaction: 0x98610e0a20b5ebb08c40e78b4d2271ae1fbd4fc3b8783b1bb7a5687918fad54e
The Root Cause
- Although the root cause is still unknown, one of the speculations suggests that the root cause of the hack was a compromise of the private key.
- This means that the attacker somehow got access to the private that gave him access to all the funds
- There are many reasons through which compromise of private keys can happen :
- Social Engineering – The attacker tricks you into giving them your private key
- Malicious Software – Once installed, they will steal private keys from your system
- Supply Chain Attack – This involves targeting the weak link of the supply chain. In blockchain, these are usually employees with redundant access to the core.
- Brute Force – This involves guessing the private key until the right combination is achieved.
Flow of Funds
The attack included $41M worth of cryptos being drained from
- $15.7M on Ethereum (9.62K ETH)
- $1.1 M USDC
- $3.9 M USDT
- $900k DAI
- 6000 ETH
- $7.85M on Polygon (14.24M MATIC), and
- $17.75M on BNBChain (82.65K BNB)
The attack seems to be very well-orchestrated
These are the addresses that are involved after the attack
ETH
0x3130662aece32f05753d00a7b95c0444150bcd3c
0x94f1b9b64e2932f6a2db338f616844400cd58e8a
0xba36735021a9ccd7582ebc7f70164794154ff30e
0xbda83686c90314cfbaaeb18db46723d83fdf0c83
0x7d84d78bb9b6044a45fa08b7fe109f2c8648ab4e
MATIC
0xfe3f568d58919b14aff72bd3f14e6f55bec6c4e0
0xa26213638f79f2ed98d474cbcb87551da909685e
0xf835cc6c36e2ae500b33193a3fabaa2ba8a2d3dc
0xa2e898180d0bc3713025d8590615a832397a8032
0x32860a05c8c5d0580de0d7eab0d4b6456c397ce2
BSC
0x4464e91002c63a623a8a218bd5dd1f041b61ec04
0x0004a76e39d33edfeac7fc3c8d3994f54428a0be
0x95b6656838a1d852dd1313c659581f36b2afb237
0xbcedc4f3855148df3ea5423ce758bda9f51630aa
0xe03a1ae400fa54283d5a1c4f8b89d3ca74afbd62
0xff29a52a538f1591235656f71135c24019bf82e5
