How a group of hackers entered BadgerDAO and stole $120 million

How a group of hackers entered BadgerDAO and stole $120 million

7 December 2021

updated 8 December 2021

1.6 k views

Marius Bogdan Dinu

@bdinu89

BadgerDAO

Although the blockchain world is taking significant steps forward in terms of security, sometimes the system fails to protect its users. For example, last week, the BadgerDAO exchange was the victim of a hacker attack that, in a few minutes, did a great deal of damage to the portal.

With access to only 23 wallets, the hackers managed to withdraw BTC and ETH worth $120 million. Investigations into the theft are ongoing, and Badger provides full support to the authorities to clarify what happened.

This article will highlight the facts known so far about this sad story.

What we know so far

Robbing a blockchain is not exactly like planning a bank robbery. If a common criminal can steal a small bank branch, hacking a blockchain is complex.

BYDFI

Up to $8000+ in Deposit Rewards

The typical transparency of a blockchain transaction helps us understand what happened. Within minutes, the hackers emptied 23 wallets on BadgerDAO, with few significant transactions.

It is impressive to see, for example, the withdrawal of 896 BTC from a single wallet. This withdrawal alone amounts to over $ 40 million with the current market quote. To achieve this, the hackers activated a malicious script on the portal.

What is even more curious is the logic behind activating this JavaScript software. It seems that the script was active for a few seconds at random daily intervals as early as November 10th. This technique was crucial to avoid the immediate identification of the problem.

When BadgerDAO discovered the problem, it immediately blocked every running smart contract. Unfortunately, this means that the portal stopped working, waiting to know the investigation results.

What appears truly scary is, in reality, the apparent simplicity of overcoming the two-factor authentication system by the hackers. This seems to be the most important node of the matter.

How two-factor authentication works

While readers are likely to use two-factor authentication every day, we find it helpful to explain how it works briefly.

The idea of two-factor authentication is simple and intelligent:

First factor: users must first enter their email and password to access a website
Second factor: once the first step is completed, users must give an access confirmation through a different source (e.g., a code sent by email)

The creators of this type of system knew well that, in general, the first factor alone is not secure enough. However, since the most used passwords online are straightforward to guess, a hacker can easily overcome this obstacle.

Introducing a second factor should make a hacker’s job virtually impossible. Unfortunately, as we will see shortly, it is important not to overestimate this type of technology.

The opinion of the experts

Anyone who thinks they can peacefully sleep thanks to multi-factor authorization (MFA) is simply wrong. But, unfortunately, such a new and innovative invention can fall victim to the oldest hacker trick: phishing.

Let’s imagine receiving an email from a work colleague’s email address. The message reports a request to click on a seemingly harmless link which, unfortunately, triggers a chain reaction that is very difficult to block.

Tools developed by white-hat hackers (like Evilginx) perfectly bypass an MFA system. The explanation of how this is possible is somewhat technical, and all one needs to know is that a simple click can disable the reliability of such a system.

Phishing education should be regular training for students, employees, and managers. Hackers are getting better and better at this, and, therefore, users need to pay more attention. Badger claims to be very careful about security issues, but this is not enough.

It is impossible to attribute cybersecurity’s responsibility entirely to an exchange; users too must do their part. There are many online courses dedicated to the subject of phishing, and it is good to learn more about it before putting your money at risk.

What seems to have happened

The security of the BadgerDAO portal relies on Cloudflare technology. Unfortunately, the hackers could access the Cloudflare cybersecurity system with ease. A user can enter Cloudflare through a complex API key, which only those who created the account should access.

Viewing the API key requires using the MFA system described in the previous section. A blockchain typically uses the technology known as “Web3”. However, it would appear that the hackers could use the Web2 protocol to bypass the problem.

What we can learn from this story

You are not wrong if you feel like having a déjà-vu while reading this story. PayPal, for example, suffered from a similar attack in 2020. The criminals bypassed the two-factor authentication system of the company thanks to a phishing-related scam.

Other players in the blockchain industry have also suffered from losses due to hackers. No one can forget the $600 million that hackers stole from the Poly Network during the Summer. This amount was (and, we hope, will always be) the highest heist in the DeFi history.

BYDFI

Up to $8000+ in Deposit Rewards

Does complete cybersecurity even exist?

The short answer is simple: no, it does not. There’s a reason if your antivirus software keeps on asking to reboot the system to install new updates. Hackers are getting smarter and better at their job, and cybersecurity is evolving with them.

The problem is that, unfortunately, sometimes hackers prove to be one step ahead of security systems. Sometimes, one step is enough to lose a massive amount of money that it may never retrieve.

We all need to understand the danger of delegating cybersecurity entirely to a piece of code. Internet security needs to be taught and learned continuously, and our antivirus software should not be the only weapon to be updated from time to time.

Btc

Bitcoin

$62.547
price

0.84959%
price change

TRADE NOW

The malicious script running for about three weeks without attracting attention is also very serious. The activation of the API keys was instantaneous, but their theft was carried out calmly and with care. Nevertheless, platforms like BadgerDAO still have a lot to learn about cybersecurity, and we hope this story is the last of its kind.

Bitcoin Breaks $51,000 As Whales Buy The Dip

Jack Dorsey’s Spiral Announces Dev Kit For Lightning Network

Written by

Marius Bogdan Dinu

@bdinu89

312 posts

Bogdan is a genuine outside-the-box thinker. His philosophy is never to settle and always evolve. Since the very first moment, he heard of Bitcoin, he knew it would revolutionize the world.

VIEW AUTHOR

Publish your own article

Guest post article. Guaranteed publishing with just a few clicks

START PUBLISHING ADVERTISE WITH US

Browse categories

Explore trending topics in the crypto community right now.

Bitcoin

SEC Greenlights Multiple Bitcoin ETFs, Signaling Major Leap for Cryptocurrency Markets

The U.S. Securities and Exchange Commission (SEC) has made a landmark decision by approving 11 spot bitcoin exchange-traded funds (ETFs). This move represents a significant moment in the cryptocurrency industry, marking a shift towards greater institutional adoption and accessibility for investors. The approved ETFs include products from major firms such as BlackRock’s iShares Bitcoin Trust, Grayscale Bitcoin Trust, ARK 21Shares Bitcoin ETF, Bitwise Bitcoin ETP Trust, WisdomTree Bitcoin Fund, Fidelity Wise Origin Bitcoin Trust, VanEck Bitcoin Trust, Invesco Galaxy Bitcoin…

Marius Bogdan Dinu

@bdinu89

1 year ago 597 views

Bitcoin Should be Banned in the United States: Charlie Munger

Berkshire Hathaway’s vice chairman, Charlie Munger, called for a ban on cryptocurrency in the United States on Monday, similar to the one in China. In an op-ed published with the Wall Street Journal, Munger argued that Bitcoin isn’t a currency, commodity, or security, but simply a form of gambling “ with a nearly 100% edge for the house. As such, the enactment of a federal law should ban such things from happening. Munger cited the Chinese communist party’s ban on…

Andrew Throuvalas @andrew

2 years ago 1.5 k views

Tesla’s BTC Positions Remained Unchanged in Q4 of 2022

According to a new earning report from automotive manufacturer Tesla, the company did not sell any of its BTC holdings in the fourth quarter of 2022. Amid speculations that the company had traded BTC during the testing bears, CEO Elon Musk revealed it was yet holding on to its BTC stash. Tesla Maintains Holdings After Initial Sell-Off In Q2 of 2022, Tesla opted to sell 75% of all its BTC. The car manufacturer received close to $950M in exchange. Notably,…

Daami PK @Daami

2 years ago 1.5 k views

Here’s When Grayscale Debates the SEC in Court on its Bitcoin Spot ETF

The District of Columbia Court of Appeals has marked a date for when Grayscale and the Securities and Exchange Commission (SEC) may present oral arguments regarding the approval of a Bitcoin spot ETF. Each side will present its case at 9:30 am ET on March 7, with the SEC arguing against the product, and Grayscale arguing in favor. Grayscale VS SEC The court date – revealed in a court order filed on Monday according to CNBC – is much earlier…

Andrew Throuvalas @andrew

2 years ago 1.8 k views

Ethereum

Ethereum’s Zhejiang Staking Withdrawal Testnet for Shanghai is Live

At 15:00 UTC on Wednesday, the much-anticipated Zhejiang testnet for staking withdrawal went live on Ethereum’s Beacon chain. Zhejiang will enable the testing of the Ethereum Improvement Proposal (EIP) 4895 which allows for staking withdrawals. This is in preparation for the network’s next major update, the Shanghai hard fork slated to launch sometime in March. Users Can Make Simulated Withdrawals with Zhejiang In a tweet yesterday, DevOps engineer at Ethereum foundation Barnabas Busa gave details about the Zhejiang testnet slated…

Daami PK @Daami

2 years ago 1.6 k views

Ethereum Devs Disagree Over Technical Tweak as Shanghai Upgrade Nears

Post-merge Ethereum users have been eagerly awaiting the commencement of the network’s next major upgrade, Shanghai. However, after over 3 months of prep time, it appears the Shanghai rollout isn’t going as smoothly as expected. What Exactly is the Shanghai Upgrade? In September last year, the much-publicized Ethereum Merge also known as the Ethereum 2.0 upgrade went live. Ethereum underwent some significant changes as its consensus mechanism transitioned from proof-of-work to a cost-efficient proof-of-stake system. However, since the Beacon launch…

Daami PK @Daami

2 years ago 1.6 k views

FTX Hacker Converts 50k Stolen ETH to BTC

Per a report from blockchain analysis firm Chainalysis, the attacker behind the Nov 11 FTX exploit, is converting the stolen ETH to Bitcoin. There were muted fears the seemingly inexperienced perpetrator could dump all its ETH holdings. On Sunday, the attacker dumped 50k ETH on-chain, with ETH's price dipping by almost 7%. https://twitter.com/chainalysis/status/1594349583416840199?s=20&t=pgvQHeVytI20eKQ1ls9bxw Hacker Moves 50,000 ETH to New Address Over the past week, the perpetrator had been steadily swapping the cryptocurrencies they had carted off for Ether tokens. This…

Daami PK @Daami

3 years ago 1.9 k views

Censorship Concerns: 51% of Ethereum Blocks Now OFAC Compliant

According to new data, over half of the blocks on the Ethereum network now reportedly comply with the US Treasury OFAC’s standards. This comes roughly a month after the platform’s monumental merge update. Phasing Out Tornado Cash The Office of Foreign Assets Control is the intelligence and enforcement agency of the US Treasury Department. Indeed, the OFAC administers and enforces US financial sanctions. A prime example of this is the recent, highly-publicized ban on crypto mixer Tornado Cash. According to…

Daami PK @Daami

3 years ago 1.8 k views

Trading

How to Leverage Arbitrage Opportunities in Crypto Markets

Cryptocurrency arbitrage has become an increasingly popular investment strategy as the crypto market grows and evolves. Arbitrage involves taking advantage of pricing discrepancies between markets or exchanges to profit. Investors can leverage profit opportunities by understanding cryptocurrency arbitrage while managing associated risks. In this guide, we'll explore cryptocurrency arbitrage and how it works. A Bitcoin-related example will help us illustrate the concepts of this strategy. What is Arbitrage and How Does it Work in Crypto Markets Crypto arbitrage trading is…

Gianluca Longinotti @Gianluca

2 years ago 3 k views

The Different Types of Copy Trading in Crypto

Are you interested in trading cryptocurrencies but feel intimidated by the complexity of the process? Copy trading is a great way to get into crypto without needing to be an experienced trader. With copy trading, investors can benefit from the experience and knowledge of more experienced traders, allowing even beginners to succeed. How does copy trading work, and which tips do you need to know to succeed? In this article, we'll explore all aspects of copy trading in crypto. What…

Gianluca Longinotti @Gianluca

2 years ago 1.7 k views

How to Spot an Unsafe Crypto Exchange

Cryptocurrency exchanges have become increasingly popular as they provide a platform for people to buy and sell digital assets. Unfortunately, not all crypto exchanges are safe or reliable. With the rise of cybercrime and fraud, you must learn to spot an unsafe crypto exchange before investing your money. This guide will help beginners identify and avoid potential risks when selecting a cryptocurrency exchange. The Role of Crypto Exchanges on the Digital Assets Market Cryptocurrency exchanges play a crucial role in…

Gianluca Longinotti @Gianluca

2 years ago 2.2 k views

What Is Grid Trading in Crypto?

Crypto grid trading has become a popular strategy because of its ability to help traders capitalize on market volatility. Grid trading means you can produce consistent profits by taking advantage of price differences in different markets or time frames. By establishing buy and sell orders at predetermined intervals, you can take advantage of these fluctuations in an automated way. This guide will explore the different aspects of grid trading and provide an overview of its benefits, challenges, and more. Through…

Gianluca Longinotti @Gianluca

2 years ago 1.6 k views

Tech

Introducing una Messenger: A Paradigm Shift in Blockchain Connectivity

The digital landscape is set for an unprecedented transformation with the introduction of una Messenger, the latest innovation from web3 development powerhouse Wemade. This platform represents an evolution of the "PAPYRUS Messenger," serving as the cornerstone of the ambitious "unagi" initiative, aimed at catalyzing the mass adoption of blockchain technology. The "Unbound Networking & Accelerating Growth Initiative" seeks to bridge the divides between diverse blockchain services and networks, heralding a new era of interconnectedness. A New Frontier in Blockchain Communication…

Marius Bogdan Dinu

@bdinu89

1 year ago 574 views

Bit2Me Champions WEMIX Token in Pioneering European Listing

Bit2Me, Spain's premier virtual asset exchange, has recently broadened the horizons for cryptocurrency enthusiasts by listing WEMIX, the cornerstone token of the WEMIX3.0 blockchain ecosystem. This marks a notable achievement as WEMIX's inaugural venture into the European market, emphasizing the token's role in facilitating a range of blockchain-based activities, from gaming transactions to decentralized finance (DeFi) applications. Launched with the intention to democratize access to WEMIX for the 450 million Spanish speakers around the globe, this strategic move aligns with…

Marius Bogdan Dinu

@bdinu89

1 year ago 404 views

CryptoVirally Expands with Fresh Crypto Marketing Offers and Cointelegraph Upgrades

In an exciting update for the cryptocurrency marketing landscape, CryptoVirally has announced a series of new entries and enhancements to its already comprehensive range of services. These updates, aimed at providing tailored marketing solutions for crypto projects, include new limited-time offers and expanded options for Cointelegraph publications. Limited Offers: A Game-Changer in Crypto Marketing CryptoVirally's limited offers section presents an enticing opportunity for crypto projects to leverage high-impact marketing services at discounted rates. These offers, available for a limited period,…

Marius Bogdan Dinu

@bdinu89

1 year ago 465 views

Breaking Boundaries in Blockchain: WEMIX’s ‘una Wallet’ Sets New Standard for Multi-Chain Asset Management

The WEMIX Foundation has unveiled 'una Wallet,' a revolutionary digital wallet designed to offer unparalleled convenience and security in managing digital assets across various blockchain networks. The announcement, made on January 17, 2024, signifies a new era in the seamless integration of multiple blockchain protocols, including Arbitrum, Avalanche, BNB Smart Chain, Ethereum, Kroma, Optimism, Polygon, and WEMIX3.0. 'una Wallet' is more than just a digital wallet; it represents the culmination of WEMIX's innovative efforts in the blockchain space. It serves…

Marius Bogdan Dinu

@bdinu89

1 year ago 592 views

Live Prices

Wallets

Trading bots

Exchanges

Airdrops

DeFi

Dapps

Staking pools

Portfolio trackers

NFT

Others

Guides

Reviews

Bitcoin

Press Release

Research

Glossary

People

PrimeXBT

Earn Network

Ellipal

Mizar

Octav

BFG

DYP Tools

How a group of hackers entered BadgerDAO and stole $120 million

What we know so far

BYDFI

Up to $8000+ in Deposit Rewards

How two-factor authentication works

The opinion of the experts

What seems to have happened

What we can learn from this story

BYDFI

Up to $8000+ in Deposit Rewards

Does complete cybersecurity even exist?

More author posts

BYDFI Perpetual Futures

Up to 200X Leverage - No KYC Required

Publish your own article

Browse categories

Explore trending topics in the crypto community right now.

Bitcoin

Ethereum

Trading

Tech