<p>Telegram trading bots have rapidly gained traction, presenting a simple and efficient way to interact with the fast-paced world of cryptocurrencies. While these bots offer unprecedented convenience, it's essential to balance the scales by discussing the risks that accompany their benefits.</p>



<h2 class="wp-block-heading">What are Telegram Crypto Trading Bots?</h2>



<p>Telegram crypto trading bots are automated trading applications built on the Telegram messaging platform. These bots connect to decentralized exchanges and execute crypto trades on your behalf based on pre-defined algorithms and rules.</p>



<h3 class="wp-block-heading">How Telegram Trading Bots Work</h3>



<p>Telegram trading bots offer a user-friendly way to buy and sell tokens. To trade, all you need to do is paste the token's contract address into the chat, and the bot takes care of the rest. Unibot, for instance, claims to execute trades six times faster than conventional trading platforms like Uniswap.&nbsp;</p>



<p>Their seamless integration and range of functions, such as liquidity sniping and method sniping, have caused the market cap for bots in the decentralized exchange (DEX) sector to skyrocket, jumping from $5.5 million in May to <a href="https://dune.com/whale_hunter/dex-trading-bot-wars">$148 million</a> in Sept 2023.</p>



<h3 class="wp-block-heading">Key Functions</h3>



<p><strong>Buy and Sell Tokens:</strong> Seamlessly integrated into Telegram, you can execute trades by simply pasting a contract address into the chat.</p>



<p><strong>Stop Loss and Take Profit Orders:</strong> Set predefined limits for buying or selling tokens to automate your trading experience.</p>



<p><strong>Anti-Rug and Honeypot Features:</strong> These bots have built-in security measures to liquidate positions if suspicious transactions are detected preemptively.</p>



<p><strong>Copy Trading:</strong> The bots allow you to copy trades from established traders automatically.</p>



<p><strong>Multi-Wallet and Liquidity Sniping:</strong> These bots are equipped with advanced sniping techniques to circumvent wallet limitations and maximize token gains.</p>



<h2 class="wp-block-heading">Risks of Using Crypto Trading Bots</h2>



<h3 class="wp-block-heading">Security Trade-offs</h3>



<p>While these bots claim to delete access to your wallet after transactions, the opacity of their source code leaves room for skepticism. Some, like Unibot and Maestro, explicitly disclaim responsibility for unauthorized access to user accounts in their Terms of Service. The absence of end-to-end encryption in Telegram bots exposes another layer of risk.</p>



<h3 class="wp-block-heading">Risk of Unauthorized Access</h3>



<p>SIM swapping is another significant risk to consider. A hacker could gain access to your Telegram account via a text message code, leaving your assets vulnerable.</p>



<h3 class="wp-block-heading">Lack of Transparency and Regulation</h3>



<p>Most Telegram bots are closed-source and unaudited, leaving users to trust anonymous teams with their private keys and funds. This lack of transparency can be unnerving, considering the elevated access these bots have to your financial assets.</p>





<h2 class="wp-block-heading">Conclusion</h2>



<p>Telegram trading bots serve as a testament to the innovation driving the cryptocurrency trading space. They offer unparalleled convenience and efficiency but come with a side of risks that can't be ignored. It's this balance between utility and risk that makes them a double-edged sword in the evolving landscape of crypto trading. As we look toward the future, the question isn't just about what these bots can do, but also about what they should be permitted to do, especially when user security is at stake.</p>

Telegram Crypto Trading Bots: Convenience vs. Security Risks

<p class="has-medium-font-size">BREAKING: Hacken performed smart contract audits for the European Blockchain Services Infrastructure (EBSI), contributing to the safety and reliability of digital public services across Europe.</p>



<h2 class="wp-block-heading">EBSI: Europe's Blockchain Revolution</h2>



<p>Imagine a digital Europe where public services are secure, transparent, and, above all, trusted – all thanks to the power of blockchain. Enter EBSI - <a href="https://ec.europa.eu/digital-building-blocks/wikis/display/EBSI/Home">the European Blockchain Services Infrastructure</a>, an initiative by the European Commission and the European Blockchain Partnership. This powerhouse of European nations, including all EU member states plus Norway and Liechtenstein, joined forces in 2018. Their aim? Use blockchain to craft sterling public services for all Europeans.</p>



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/DHPSDxSqbM6yp50rHpUEjDIFHQ5IsLuns6XRwbNM-bP36jDiaDaeXDyW6Ly7TQO0tI4KD0NZ1xIhnvfoxz2MkQPRcjenoMPMni5UnjJUNYAsqJKE6ivaljtMwYPZSED5qzYok2lxA1HZWHsc" alt=""/><figcaption class="wp-element-caption">Source: <a href="https://ec.europa.eu/digital-building-blocks/wikis/display/EBSI/What+is+ebsi">EBSI</a></figcaption></figure>



<p>Let's unpack EBSI:</p>



<p>1. <strong>Blockchain Beyond the Hype</strong>: EBSI isn't about jumping on the blockchain bandwagon. It's about extracting real solutions from this technology, based on today’s use cases requirements. Grouped as "<a href="https://ec.europa.eu/digital-building-blocks/wikis/display/EBSI/What+is+ebsi#what-ebsi-used-for">use case families</a>," EBSI identifies and tackles key business issues across industries. Take "track &amp; trace" - it's like giving every item its unique digital fingerprint. And then there's "verifiable credentials," a gold standard in digital trust, “making information easy to verify, but impossible to fake” by using the ledger as a trusted source of information about the issuers of data</p>



<p>2. <strong>Trust Me, I'm Verified</strong>: Among the Use Case Families, EBSI's "verifiable credentials" shine bright. It's about making digital verification smooth and foolproof. How? By giving power to the people. Trusted issuers of credentials register their details on the blockchain first - for example, a university will register its accreditation as an educational body. This registration is handled by smart contracts, which are transparent, accountable, and automated pieces of software deployed in a blockchain. Then, they issue documents as Verifiable Credentials to individuals, who store them in their digital wallets - this happens entirely off-chain. If you hold a credential, you decide who verifies it and when, and it is never shown to anyone else. And with the EBSI Conformant wallet, this control is just a click away. The verification relies on blockchain and only checks the reliability of the issuers of credentials. Simple, privacy-preserving, and decentralised.&nbsp;</p>



<p>Powered by smart contracts, the technology is already revolutionizing cross-border educational opportunities in Europe. Graduates validate foreign degrees effortlessly, and PhD candidates access specialized courses abroad with ease. Students benefit locally using a European student card, while Erasmus-validated transcripts simplify higher degree pursuits. Posted workers, equipped with a portable document A1, can now work in other European countries with a proof of their insured status.&nbsp;</p>



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/Hs5i5byxrOgvCLItj8ufGnvAQGuw3lLHJXaqXfH57BmrgpMK-S_Gc5eXIUhM9of5ylXNgqlCspjklNyDC1XtSjyCXSiT4xuwkn_9-foJHGL8Kre5UM5U2VXITOxMIpj_ZU5Y57G1HUEEhnVW" alt=""/><figcaption class="wp-element-caption">Source: <a href="https://ec.europa.eu/digital-building-blocks/wikis/display/EBSI/Conformant+wallets">EBSI</a></figcaption></figure>



<p>Through EBSI, anything could be made into a Verifiable Credential. As long as a claim is made by a reputable organisation about someone, this claim can be turned into a credential that is stored in a wallet. From a user's perspective, it works like a charm through conformant wallets that store digital certifications and identity information – the perfect wallet for the digital age.</p>



<p>3. A Future-Forward Vision: Verifiable Credentials is only a glimpse of EBSI's grand plan. It's paving the way for a transparent and trustworthy digital Europe, where governments play an active role in providing trust in the decentralised, Web3 ecosystems of tomorrow. Think of EBSI as more than a tech project - it's Europe's beacon in a new digital age. By standing firm on global standards, such as W3C’s Verifiable Credentials, prioritizing user control, and banking on blockchain's strengths, EBSI is shaping a future where technology and trust go hand in hand.</p>



<p>In a nutshell, EBSI is reimagining a digital Europe that's secure, open, and inclusive. And with its innovative approach, the future looks exciting!</p>



<h2 class="wp-block-heading">Importance Of Smart Contract Auditing For EBSI</h2>



<p>As a trusted digital platform, EBSI heavily depends on smart contracts to operate efficiently. With EBSI's vast user base and the sensitive data it handles, it's crucial that these smart contracts are secure and reliable. This is where the need for thorough smart contract auditing comes in.</p>



<p><strong>How EBSI Functions</strong>: At the heart of EBSI's innovation lies its technological backbone, integrating APIs, smart contracts, and the decentralized ledger. These components seamlessly converge to offer trusted information to users, ensuring that every transaction recorded on the EBSI ledger is reliable, transparent, and secure. Whenever a business activity happens within EBSI, it's carried out through EBSI's APIs. These APIs, in turn, call upon smart contracts to perform operations and record transactions on the EBSI ledger.</p>



<p><strong>EBSI’s Secure Ledger</strong>: At the center lies its decentralized ledger—a repository of all transactions, resistant to any tampering. Like all blockchains, once a transaction is added, it cannot be altered. Specialized registries, like the Trusted Issuers registry (which stores the accreditations of issuers of Verifiable Credentials), add another layer of trust.</p>



<p><strong>Decentralization Across Europe</strong>: EBSI's services are distributed across a European network of nodes, eliminating the risk of a centralized failure point. These nodes are managed by vetted operators, all adhering to strict governance and security protocols.</p>



<p><strong>Role of Smart Contracts</strong>: EBSI has a set of APIs available to users to interact with its blockchain ledger. For example, an employer verifying the authenticity of a diploma Verifiable Credential will call an API to read the relevant entry in the Trusted Issuers Registry. But the real action happens through smart contracts. They are the gatekeepers, ensuring that operations only proceed when necessary conditions are met. EBSI has tight controls on these contracts, ensuring only legitimate operations go through. For example, the Smart Contracts ensure that only accredited trusted issuers are able to record transactions on the trusted issuers' registry.</p>



<p>In conclusion, auditing the smart contracts used by EBSI is not just about checking code. It's about ensuring trust, integrity, and the seamless operation of a platform aiming to revolutionize digital trust in Europe.</p>



<h2 class="wp-block-heading">Summary Of Hacken's Audit Approach And Methodology</h2>



<p>Hacken adopted a systematic and rigorous approach to auditing EBSI's smart contracts. Our audit incorporated the following principles:</p>



<ol>
<li><strong>Thorough Analysis</strong>: A deep dive into each smart contract to understand its functionality and design.</li>



<li><strong>Automated Scanning</strong>: Using advanced tools to scan for common vulnerabilities.</li>



<li><strong>Manual Review</strong>: To catch complex, logic-based vulnerabilities that automated tools might miss.</li>



<li><strong>Continuous Feedback</strong>: Engaging with the EBSI team to discuss potential concerns and ensure alignment.</li>
</ol>



<div class="wp-block-group">
<p class="has-text-color has-background" style="color:#acffff;background-color:#1b7bdb"><em>Testimonial from the EBSI team</em>:<br>"Hacken's meticulous approach to the audit process ensured that our smart contracts were reviewed comprehensively. Their professionalism and dedication were evident throughout the audit."</p>
</div>



<p>In essence, <a href="https://hacken.io/discover/smart-contract-audit-process/">Hacken's smart contract audit process</a> is a harmonious blend of human expertise and technological prowess, ensuring EBSI's smart contracts stand resilient against any attacks. Let’s break it down.</p>



<p>It began with the <strong>pre-audit</strong> stage. Here, EBSI was presented with an overview of its functional requirements, technical description, development environment, and unit tests.</p>



<p>Next followed the <strong>overall review</strong>, during which Hacken's auditors scrutinized the code. Guided by EBSI’s documentation, this phase was pivotal in establishing a clear understanding of the smart contract's architecture.</p>



<p>Subsequently, the<strong> automated tool scan</strong> was initiated. Deploying specialized tools for Solidity like Slither, Mythril, and Echidna, and cross-referencing with the <strong>SWC registry</strong>—a comprehensive database of known vulnerabilities—the audit ensured a rigorous check for potential lapses.</p>



<p>Informed by this, <strong>data flow diagrams</strong> were drawn with Solgraph. These visual representations facilitated a structured approach to the contracts' operations, streamlining the eventual <strong>line-to-line review</strong> – the most crucial step of the entire audit process.</p>



<p>The <strong>testing phase</strong> proved invaluable. EBSI's existing tests were evaluated and complemented with additional tests when necessary. This phase also involved simulating real-world scenarios to unearth any hidden vulnerabilities.</p>



<p>Post analysis, the team convened for a collaborative discussion. Here, findings were studied, debated, and <strong>remediation</strong> <strong>strategies</strong> were outlined. Every vulnerability was paired with a solution, ensuring the contracts' fortification.</p>



<p>The culmination of these rigorous steps was a comprehensive <strong>report</strong> handed to EBSI. Furthermore, a <strong>security</strong> <strong>score</strong> was provided, offering a quantifiable measure of the contracts’ robustness.</p>



<h2 class="wp-block-heading">EBSI Smart Contract Audit</h2>



<p>Our <a href="https://hacken.io/services/blockchain-security/solidity-smart-contract-security-audit/">Solidity audit</a> encompassed 63 EBSI's smart contracts, vital for services like authenticating transactions, guaranteeing the integrity of tamper-proof registries, enabling interactions through the EBSI API, and maintaining decentralization of EBSI Ledger.</p>



<p>While the specifics about vulnerabilities cannot be shared, we can confirm that our findings played a significant role in strengthening the security and functionality of EBSI's operations, ensuring its commitment to transparency and trust remains unshaken. They achieved a perfect average security score of 10 across all smart contracts involved, an exceptional accomplishment in this field. Moreover, the EBSI team was quick and decisive in addressing identified issues.</p>



<p>The final scores are exceptionally high for all the audited services.</p>



<figure class="wp-block-table is-style-stripes has-medium-font-size"><table><thead><tr><th><strong>Service</strong></th><th><strong>Brief Description</strong></th><th><strong>Score</strong></th></tr></thead><tbody><tr><td>DID-REGISTRY-V4</td><td>A section for DIDs documents' storage and management</td><td>9.8/10</td></tr><tr><td>TRUSTED-ISSUERS-REGISTRY&nbsp;</td><td>A service anchor for Trusted Issuers, enabling verification of issuer DIDs and their authorization</td><td>10/10</td></tr><tr><td>TRUSTED-SCHEMAS-REGISTRY</td><td>A service anchor for verifying trusted schemas and their statuses</td><td>10/10</td></tr><tr><td>TRUSTED-APPS-REGISTRY</td><td>An anchor of trust, listing trusted apps and their details for access management across EBSI services</td><td>8.1/10</td></tr><tr><td>TRUSTED-POLICIES-REGISTRY</td><td>A service facilitating authorization across the project</td><td>9.9/10</td></tr><tr><td>TIMESTAMP</td><td>A service for storing versioned hashes</td><td>9.6/10</td></tr><tr><td>BOOTSTRAP</td><td>A set of libraries used throughout the project</td><td>9.7/10</td></tr><tr><td>PROXY</td><td>A service offering proxy functionality</td><td>10/10</td></tr></tbody></table></figure>



<p>Together, all these contracts create a powerful Identity Management &amp; Authentication and Storage platform.</p>



<h2 class="wp-block-heading">Hacken's Promise For Ongoing Support To EBSI's Growth And Security</h2>



<div class="wp-block-group">
<p class="has-text-color has-background" style="color:#acffff;background-color:#1b7bdb"><em>Reflecting on our collaboration, the EBSI Team shared</em>:<br>“Hacken's audit was invaluable for EBSI. Their insights and recommendations have significantly enhanced our platform's security and reliability. We are grateful for their expertise.”</p>
</div>



<p>We are profoundly grateful and honored by the trust placed in us by EBSI and cherish the constructive feedback. But Hacken's commitment does not end here. We pledge our continuous support to EBSI, ensuring its growth and security align with evolving technologies and threats. As the European Commission continues to be an emblem of trust and innovation, Hacken is ready to stand by its side, safeguarding its integrity and excellence.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<h2 class="wp-block-heading">Conclusions</h2>



<p>EBSI operates as a trusted digital platform, and its functionality relies heavily on smart contracts. These digital contracts execute operations when specific conditions are met. Given the public nature of EBSI and the critical data it handles, ensuring the utmost security, efficiency, and reliability of these smart contracts becomes imperative. Thus, a comprehensive smart contract audit provided by Hacken was essential to mitigate potential vulnerabilities and maintain the trust and reliability that EBSI promises to its users.</p>



<p>From a broader perspective, EBSI is not merely a technological project; it's a testament to Europe's commitment to fostering innovation, trust, and efficiency in the digital age. Its purpose-driven approach, backed by the power of blockchain, has the potential to redefine standards of verification, interaction, and trust for businesses, governments, and citizens alike.</p>



<p>EBSI's commitment to leveraging blockchain for the public good is commendable. With Hacken's expertise, we are ensuring that this commitment is upheld with unwavering security, trust, and efficiency.</p>

Case Study: Hacken's Audit of EBSI Smart Contracts

<p>We're thrilled to announce a new partnership between Hacken and KuCoin Community Chain (KCC). The partnership combines Hacken's expertise in digital security with KCC's unique community-run blockchain, all in an effort to build a safer and more frictionless Web3.</p>



<h2 class="wp-block-heading">About KuCoin Community Chain (KCC)</h2>



<p><a href="https://www.kcc.io/">KCC</a> is a public chain project initiated and built by the developer communities of KuCoin Token (KCS) and KuCoin aiming to solve the network latency and high gas fee of Ethereum. KCC is an EVM-compatible blockchain and is striving to provide community users and developers with a higher-speed, more convenient, and lower-cost blockchain experience. Launched in 2021, the chain runs a modified version of PoS consensus called Proof of Staked Authority.</p>



<p>KCC is actively incentivizing Web3 developers to build on its chain through the <a href="https://www.kcc.io/gas-revenue">$500,000 Gas Revenue and Grants Program</a>. Starting today, projects building on KCC also get exclusive benefits from Hacken – a trusted blockchain security auditor since 2017.</p>



<h2 class="wp-block-heading">Key Highlights Of Our Proposed Partnership</h2>



<p>Demonstrating an unwavering commitment to Web3 security, Hacken looks forward to enhancing the ecosystem's security and implementing risk-reduction strategies for KCC and its associated projects.</p>



<h3 class="wp-block-heading"><strong>Exclusive Offers For KCC Ecosystem</strong></h3>



<p><strong>Discounts</strong>: Up to 20% off for KCC &amp; KuCoin ecosystem projects to the most comprehensive suite of blockchain security solutions.</p>



<p class="has-text-color has-background" style="color:#acffff;background-color:#1b7bdb"><em>Note: To take advantage of these exclusive discounts and benefits, simply indicate that you are participating through the KCC and KuCoin partnership program by adding a comment in the request form on our website.</em></p>



<p><strong>Priority Queue</strong>: KCC ecosystem projects get a priority queue to meet their urgent needs.</p>



<p><strong>Bug Bounty</strong>: A dedicated program placement and triage service via HackenProof for up to 20 KCC ecosystem projects at no extra cost.</p>



<p><strong>Dedicated Support</strong>: An exclusive Partnership Manager for the KCC ecosystem to ensure smooth and productive cooperation.</p>



<p><strong>Visibility Boost</strong>: Integrations with CoinGecko &amp; CoinMarketCap, a free listing on CER.live, and cross-referral opportunities. A special feature on Hacken's Partners page – coming soon.</p>



<p><strong>Joint Marketing Initiatives</strong>: Robust marketing backing on social media. Plus, shared educational activities, AMAs, and enlightening content produced by Hacken's R&amp;D team.</p>



<p><strong>Security Guide</strong>: Comprehensive Security Guide exclusive for KCC ecosystem builders – coming soon.</p>



<p>Over the years, Hacken and KuCoin have fostered a collaborative relationship rooted in trust and mutual growth. For years, KuCoin has been proactively elevating its cybersecurity framework, turning to Hacken for its proven expertise. Our history dates back to an <a href="https://hacken.io/case%20studies/pentests-and-bug-bounties-for-kucoin/">in-depth security assessment in July 2021</a>. Our joint efforts not only led to the enhancement of KuCoin's security parameters but also solidified a bond that prioritized the safety and trust of the cryptocurrency community. As KuCoin continuously innovated and launched new products, Hacken remained their security ally through a <a href="https://hackenproof.com/kucoin/kucoin">HackenProof bug bounty program</a>, underscoring a path that symbolizes resilience, commitment, and progress.</p>



<p>The partnership with KCC is the latest testament to this enduring relationship, promising a future where the crypto space thrives on transparency, safety, and trust. Join us as we continue forging a path of innovation and security together.</p>

Announcing New Partnership: Hacken & KCC Join Forces

<p>Dear Hacken Community,</p>



<p></p>



<p>Today, Hacken is celebrating its 6th anniversary. From our startup beginnings in 2017 to today, we've come a remarkable distance. Each milestone reached, and every success achieved is a testament to our constant pursuit of excellence in blockchain security. It's been an incredible journey, filled with learning and growth, as we've stepped into new horizons and made our mark in the Web3 world. </p>



<p>The biggest DeFi protocols and Web3 players trust us, which is the strongest evidence of our commitment to quality. This year, WeMix, Radix, Venus, Civic, NEAR, Venom, CowSwap, and hundreds of other Web3 projects have chosen us as their trusted security auditor. Our ability in blockchain security caught the attention of many, including spotting a critical bug in Binance's Proof of Reserves System—a testament to our attention to detail and excellence. We have also become an official security partner for Polygon Village and Radix ecosystems.</p>



<p>Our contribution to a safer Web3 didn't stop with security audits. Under CER, we introduced the industry's first-ever crypto wallet rating. Extractor, our post-deployment security tool, quickly gained traction, impressing its first clients. Our HackenProof bug bounty platform identified an impressive 5,800+ bugs valued at $5 million. All the while, we've been leading a movement in community-led research with our 4,600 Trust Army members.</p>



<p>We believe in securing the present and shaping the future. By sharing our knowledge with the world and championing the best security practices in the Web3 ecosystem, we make a lasting impact. We captivated the stage at top crypto events like Web Summit 2022, DeFi Security Summit, and Consensus 2023. We signed a Letter of Cooperation with the city of Incheon, a global crypto hub in South Korea, and formed a partnership with the Dubai Blockchain Center to further our reach in the UAE. Our involvement in initiatives like the BNB Chain Zero2Hero Incubator, Cronos Builders Program, HyperNest Accelerator, and Venom Hackathon showcases our dedication to fostering the next generation of projects and talents.</p>



<p>Now, to our token – HAI. In recent months, we’ve seen a rapid surge in active addresses, and we’re working to make our token as accessible and popular as possible: we are preparing a two-click purchase, updating the hAI app, and gearing up for deployment on more active networks, such as zkSync and BNB Smart Chain. Yet, our ambition for HAI goes beyond just accessibility; we're shaping it as a true Governance, Work2Earn, and DYOR asset. To that end, we have created new tokenomics, added fixed utility, and transitioned into a real hDAO, with our first committee already handling RFPs. Our success as a company is closely intertwined with the token’s success, and we want to reflect that.</p>



<p>Looking back, it's evident that our journey wasn't without its challenges. But like every dedicated team, we learned, adapted, and emerged stronger. Dreaming big will always be our way, no matter what.</p>



<p>This year marks our 6th anniversary – a milestone that speaks volumes about our resilience and commitment. As we stand at this point, we're more energized than ever to make even bigger strides in Web3 security. In the upcoming bull run, we want to maintain our reputation for quality and expand our influence in the industry.</p>



<p>I want to extend a heartfelt thank you to our community, partners, and everyone who's been part of our journey. Your support has been the foundation of our success. Thank you for choosing Hacken as your trusted blockchain security auditor.</p>



<p>Let's come together, celebrate our shared journey, and look forward to many more chapters of innovation, growth, and leadership in the Web3 world.</p>



<p></p>



<p>With gratitude and resolve for the future,</p>



<p>Dyma Budorin,</p>



<p>Co-Founder &amp; CEO, Hacken</p>

Letter To Our Valued Community, Partners And Friends

<p>In the landscape of Web3, the 51% attack stands out among other <a href="https://hacken.io/insights/blockchain-security-vulnerabilities/">blockchain security vulnerabilities</a>. It's an exploit that undermines the core principle of decentralization in blockchain, allowing hackers to manipulate transactions, exemplified by the notorious <a href="https://www.bleepingcomputer.com/news/security/hacker-makes-over-18-million-in-double-spend-attack-on-bitcoin-gold-network/#:~:text=Hacker%20made%20over%20%2418%20million,%2418%20million%20from%20his%20attacks.">$18 million double-spend attack</a> on Bitcoin Gold.</p>



<p>This article takes an in-depth look at this vulnerability, unfolding its working mechanisms, potential risks, and security measures.</p>



<h2 class="wp-block-heading">What Is A 51% Attack?</h2>



<p>A 51% attack is an attack on a blockchain network where a single entity gains control of more than half (51%) of its staking or computational power. This disproportionate control allows them to implement substantial changes, contravening the decentralization principle fundamental to the blockchain. In other words, a 51% attack gives the power to rewrite tx history, prevent tx completion, stop rewards to validators, and double spend.</p>



<p>It's important to note that a 51% attack is among the most significant security threats to blockchains, particularly those utilizing Proof-of-Work and Delegated Proof-of-Stake <a href="https://hacken.io/discover/consensus-mechanisms/">consensus algorithms</a>. One alarming outcome of such an attack is a <a href="https://hacken.io/discover/double-spending/">double-spending</a>, where the same coins are spent more than once, damaging the trust and reliability of the blockchain.</p>



<h2 class="wp-block-heading">How Does A 51% Attack Work?</h2>



<p>Diving deeper into the mechanics of a 51% attack, let's explore the step-by-step process an attacker follows to gain and exploit control over a blockchain network. While the exact specifics of an attack can vary depending on several factors, here’s a simplified, general sequence of events that typically characterizes such an attack:</p>



<ol>
<li><strong>Accumulate Power:</strong> The first step involves the attacker accumulating more than half (51%) of the network's computational or hashing power. This could be accomplished by acquiring substantial hardware resources or convincing a large number of miners to join a pool under the attacker's control.</li>
</ol>



<ol start="2">
<li><strong>Partitioning:</strong> The attacker, now commanding a majority of the network's hashing power, effectively segregates their group from the main network while still maintaining internal communication. Despite this separation, the hacking group proceeds with mining operations but refrains from sharing their progress with the primary network or receiving updates from it. Consequently, two parallel versions of the blockchain start evolving independently.</li>
</ol>



<ol start="3">
<li><strong>Fast-Paced Mining:</strong> Due to their superior hashing power, the attacker's group is able to add blocks to their version of the blockchain faster than the rest of the network. Over time, the difference in length between the two versions of the chain becomes statistically proportional to the difference in hashing power between the two groups.</li>
</ol>



<ol start="4">
<li><strong>Reintegration and Dominance: </strong>Once the hacking group rejoins the network, the two competing versions of the blockchain propagate through the entire network. According to the consensus protocol's rules, the nodes keep the longest blockchain, and the shorter one is discarded. This means all the blocks added by the main network during the separation period get orphaned, and their transactions are released back into the Mempool.</li>
</ol>



<ol start="5">
<li><strong>Potential Threats:</strong> Upon successful execution, a 51% attack can open Pandora's box of threats that can significantly impact a blockchain network and its participants. These threats range from financial fraud in the form of double-spending to outright denial of service attacks that paralyze network functionality.</li>
</ol>



<h2 class="wp-block-heading">High Cost Of 51% Attacks</h2>



<p>It's worth noting that a 51% attack is not an easy task, it requires a significant amount of resources and time. This hefty financial and technical load makes it unaffordable for most people.</p>



<p>The bulk of the cost lies in the required mining equipment. To control over half of a network's hash power, you need a lot of high-performance hardware, running into <a href="https://www.crypto51.app/">millions of dollars</a> for prominent blockchains like Bitcoin.&nbsp;</p>



<p>But it's not just about hardware. Mining consumes a lot of energy. Bitcoin mining used up to <a href="https://www.statista.com/statistics/881472/worldwide-bitcoin-energy-consumption/">95.58 TWh</a> yearly, which is on par with the annual energy consumption of Finland with over 5.5 million people. So, there are significant electricity and maintenance costs to consider.</p>



<p>Apart from the high costs, timing is crucial for a group planning an attack on the network. They need to control more than half of the network and introduce their altered blockchain at the perfect moment. If the attack fails, the hackers could lose everything.</p>



<p>On top of that, in a decentralized environment, there is no central authority to enforce the use of a compromised chain. Validators and clients can agree to restart the chain from a point before the attack occurred, although it would be messy and undesirable.</p>



<p>The high costs and risks associated with such an attack serve as a strong deterrent, particularly for larger networks like Bitcoin or Ethereum. On the other hand, smaller blockchains don't have as much mining power, making them more vulnerable. But it's easier to rent mining power for a few hours from a service like <a href="https://www.nicehash.com/">Nicehash</a> to hack these smaller networks, which cuts down the cost of the attack significantly.</p>



<h2 class="wp-block-heading">Risks And Consequences Of A 51% Attack</h2>



<p>A successful attack can have significant implications for a blockchain network and its users. Here's what happens:</p>



<ul>
<li><strong>Double-Spending</strong>: This is the most feared consequence. The attacker could spend their money twice — first, they perform a regular transaction and then change the blockchain to show they never used the money at all.&nbsp;</li>
</ul>



<ul>
<li><strong>Denial-of-Service (DoS) Attack</strong>: The hacker takes over and blocks the addresses of other miners for a while. This stops the good guys - the honest miners - from getting back control of the network. As a result, the attacker's false chain of transactions can become permanent.</li>
</ul>



<ul>
<li><strong>Transaction Reversal</strong>: The attacker can block payments between some or all users. This disrupts the normal operation of the network and can lead to significant delays in transaction confirmations, undermining confidence in the network's reliability.</li>
</ul>



<ul>
<li><strong>Damage to Reputation</strong>: Also, the attack can severely damage a blockchain's reputation. This can lead to a loss of trust among current and potential users, resulting in a significant drop in the value of the associated cryptocurrency and deterring new users or investors from joining the network.</li>
</ul>



<h2 class="wp-block-heading">Real-World Cases Of 51% Attacks</h2>



<p>Throughout the history of blockchain, there have been a few notable such cases:</p>



<ul>
<li><strong>Bitcoin Gold (BTG):</strong> In May 2018, Bitcoin Gold experienced a 51% attack that allowed the attacker to double-spend approximately <a href="https://cointelegraph.com/news/bitcoin-gold-blockchain-hit-by-51-attack-leading-to-70k-double-spend">$18 million</a> worth of BTG. This event caused substantial damage to the coin's reputation and market value.</li>
</ul>



<ul>
<li><strong>Ethereum Classic (ETC):</strong> Perhaps the most frequently targeted blockchain, Ethereum Classic suffered a massive attack in August 2020, where the attacker managed to double-spend <a href="https://decrypt.co/37721/hacker-nets-over-5-million-ethereum-classic-51-attack">$5.6 million</a> worth of ETC.</li>
</ul>



<ul>
<li><strong>Vertcoin (VTC): </strong>Vertcoin, though lesser-known, experienced a 51% attack in December 2018. The attacker double-spent 603 VTCs, equivalent to roughly <a href="https://medium.com/coinmonks/vertcoin-vtc-is-currently-being-51-attacked-53ab633c08a4">$100,000</a>.</li>
</ul>



<p>These raids demonstrate significant vulnerabilities and consequences, reinforcing the need for effective security measures.</p>



<h2 class="wp-block-heading">Prevention Of 51% Attacks</h2>



<p>Mitigating these risks can be challenging, but various methods have been proposed:</p>



<h3 class="wp-block-heading">Change Of Consensus Algorithm</h3>



<p>Switching to a different consensus algorithm serves as a viable approach in reducing the likelihood of 51% attacks. Proof of Work (PoW), the initial consensus mechanism employed by many blockchains, renders itself susceptible to such attacks due to its mining concentration risk.</p>



<p>Alternatively, the Proof of Stake (PoS) consensus mechanism is less prone to such attacks as it requires a hacker to possess the majority of the blockchain's total stake, often a prohibitively expensive venture.</p>



<h3 class="wp-block-heading">Delaying Blockchain Confirmations</h3>



<p>Another effective deterrent involves delaying blockchain confirmations. This method buys time for the network to detect and potentially ward off a 51% attack. By extending the transaction confirmation time, attackers would need to sustain control over 51% of the network for a more extended period, dramatically increasing the cost and difficulty of such an attack.</p>



<h3 class="wp-block-heading">Penalty System</h3>



<p>Instituting a penalty system serves as another viable defensive strategy. For instance, the application of slashing conditions in PoS blockchains penalizes malicious actors by confiscating a portion or all of their staked tokens if they are found to be acting against the network's rules. This punitive measure significantly raises the stakes for any would-be attackers and can serve as a potent deterrent.</p>



<h3 class="wp-block-heading">Blockchain Protocol Audit</h3>



<p>Lastly, regular <a href="https://hacken.io/services/blockchain-security/blockchain-protocol-security/">blockchain protocol audits</a> are a crucial aspect of any comprehensive security strategy. These audits meticulously scrutinize the protocol to detect vulnerabilities, including potential avenues for a 51% attack. By identifying and addressing these weaknesses proactively, blockchain developers can considerably reinforce their network's defenses.</p>



<h2 class="wp-block-heading">The Bottom Line</h2>



<p>While the risk of a 51% attack is a daunting thought, it's essential to understand that the costs and complexity of carrying out such an attack make them rare. However, the potential impact and the historical precedents emphasize the importance of proactive preventive measures and continuous efforts toward making blockchain technology more secure and resilient.</p>



<p>The future of Web3 depends on our ability to tackle these challenges, turning vulnerabilities into strengths and creating a more robust and secure digital future for all.</p>



<hr class="wp-block-separator has-css-opacity"/>



<h3 class="wp-block-heading">FAQs</h3>



<div class="schema-faq wp-block-yoast-faq-block"><div class="schema-faq-section" id="faq-question-1688022410444"><strong class="schema-faq-question">What is a 51% attack?</strong> <p class="schema-faq-answer">A 51% attack is one of the biggest blockchain security issues, especially those using Proof-of-Work consensus algorithms. This attack happens when someone controls more than half (51%) of a blockchain network's mining power. This control allows them to make major decisions, breaking the decentralization concept of blockchain.</p> </div> <div class="schema-faq-section" id="faq-question-1688022421016"><strong class="schema-faq-question">What does a 51% attack do?</strong> <p class="schema-faq-answer">In a 51% attack, the entity with majority control can manipulate the blockchain in several ways. They can halt transactions and prevent them from being confirmed, reverse transactions to carry out a double-spend attack, and prevent other miners from mining new blocks. </p> </div> <div class="schema-faq-section" id="faq-question-1688022434231"><strong class="schema-faq-question">How much would it cost to 51% attack?</strong> <p class="schema-faq-answer">The cost of a 51% attack varies depending on the blockchain network in question. For example, to launch a 51% attack on the Bitcoin blockchain, an attacker would need control of the most powerful ASIC miners. The cost of this equipment alone would exceed $7.9 billion. This estimate does not include the ongoing costs of electricity and maintenance.</p> </div> </div>

51% Attack: The Concept, Risks &amp; Prevention

<p>The landscape of Web3 is ever-evolving, with an increasing need for security against smart contract exploits. This critical requirement for vigilant security measures has been met by Hacken Extractor, which began as an on-chain smart contract monitoring system. Since its initial beta launch, it has evolved into a comprehensive post-deployment security solution, a transformation catalyzed by the alarming rise in security vulnerabilities within the Web3 world.</p>



<h2 class="wp-block-heading">Summary of Hacken Extractor Updates</h2>



<p>Hacken Extractor is transitioning from a monitoring tool to a comprehensive security solution for deployed smart contracts.</p>



<p><strong>Monitoring</strong>: Improved 24/7 on-chain monitoring of your smart contracts, together with custom triggers based on smart contracts structure, ensures maximum surveillance coverage.&nbsp;&nbsp;&nbsp;&nbsp;</p>



<p><strong>Detection</strong>: Attack Detector automatically spots attacks as they go allowing you to mitigate the risks asap.</p>



<p><strong>Protection</strong>: Smart Contract Actions automatically launches pre-planned security mechanisms to protect assets on your smart contracts.&nbsp;</p>



<p class="has-pale-cyan-blue-background-color has-background">Take advantage of the new features in <a href="https://extractor.hacken.io/">Hacken Extractor's enhanced product stack</a>.</p>



<h2 class="wp-block-heading">Major Updates to Hacken Extractor’s Security Stack</h2>



<p>We are delighted to announce a significant update to Hacken Extractor, marking a substantial evolution in our journey – Extractor can now detect and respond to attacks.</p>



<p>Our goal has always been to ensure maximum security for your smart contracts, and these updates are a testament to our dedication to delivering on our security promises.</p>



<h3 class="wp-block-heading">Updated Feature: Advanced Monitoring</h3>



<p>Extractor started with 24/7 on-chain monitoring of your smart contracts, providing custom triggers based on smart contract structure to ensure maximum surveillance coverage. This feature remains a fundamental part of our product, and now we have updated it to provide <strong>Advanced Monitoring</strong>.</p>



<h3 class="wp-block-heading">New Detection Feature: Attack Detector</h3>



<p>Today, we unveil our new detection feature called <strong>Attack Detector</strong>, designed to spot attacks in progress. This feature is critical in decreasing response time and mitigating risks as soon as possible.</p>



<p>By simply adding your smart contract address, <strong>Attack Detector</strong> will send an alert upon noticing a potential attack on a specific stage, buying you time for a risk mitigation plan.</p>



<p><strong>Attack Detector</strong> is able to recognize unwanted activities and collects data on suspicious accounts and contracts. It alerts you on three main events:</p>



<ul>
<li>Interaction with a suspicious account</li>



<li>Interaction with a suspicious contract</li>



<li>Detection of a suspicious contract</li>
</ul>



<p>Each alert provides a wealth of information, including alert type, description, transaction hash, date, monitored contract information (name, address, chain), and the severity level defined by the <strong>Attack Detector</strong>.</p>



<h3 class="wp-block-heading">New Protection Feature: Smart Contract Actions</h3>



<p>The final piece of our major update is <strong>Smart Contract Actions</strong> – a feature that sets off an automated response plan that has been pre-set in Extractor. <strong>Smart Contract Actions</strong> harness the full power of planned response to protect the assets on your smart contracts.&nbsp;</p>



<p>See <a href="https://docs.extractor.hacken.io/smart-contract-actions/intro">official documentation</a> for more info.</p>



<h2 class="wp-block-heading">Integrated Security Framework</h2>



<p>Our new monitoring, detection, and protection features work together to create an integrated security framework for post-deployment smart contract security. By enhancing these features, we aim to cover the entire cycle of post-deployment security for Smart Contracts, making Hacken Extractor a comprehensive security solution.&nbsp;</p>



<p>On top of that, Extractor is the most user-friendly self-service platform for post-deployment security out there. Easy to use and doesn’t require any additional code changes/integrations in your smart contracts. Simply add your smart contract to Extractor, and use all features!</p>



<h2 class="wp-block-heading">Conclusion</h2>



<p>In the constantly evolving landscape of blockchain and smart contract technology, the need for robust and dynamic security measures has never been more important. With Hacken Extractor's major security stack updates, we aim to provide a robust response to this need.</p>



<p>We invite smart contract developers and users to utilize these updated features in <a href="https://extractor.hacken.io/">Hacken Extractor</a> and contribute to creating a safer Web3 space.</p>

Enhancing Post-Deployment Security: Hacken Extractor Update

<p><a href="https://venom.foundation">Venom Foundation</a>, Hacken’s partner and client, is launching a virtual hackathon on May 8, 2023, with a total pool prize of $225,000. Everyone interested in building their dream project on the Venom blockchain is invited to join.</p>



<p>Join Venom Hackathon here: <a href="https://hackathon.venom.network/">https://hackathon.venom.network/</a> </p>



<h2>All About Venom Hackathon</h2>



<p>Venom testnet is going live in a few days. For that occasion, the platform is launching a virtual hackathon. Here’s what you need to know about the event.</p>



<p><strong>Showcase skills and get VC exposure</strong>. Participants can showcase their blockchain development skills and business creativity to judges. Impress the top names in the blockchain industry to get the necessary exposure to VCs for your project.</p>



<p><strong>Three tracks to cover all exciting ideas</strong>. The hackathon will have the following three tracks to harness all exciting ideas and demonstrate the full power of the Venom ecosystem:</p>



<ol><li><strong>Web3, NFT &amp; Gaming</strong>. The track covers all projects in games, metaverse, social media, secure messaging, mobile applications, carbon markets, NFT marketplaces, and Soulbound tokens.</li><li><strong>DeFi &amp; CBDCs.</strong> The track covers all projects in categories of asset management, stablecoins, DEX, DAOs, lending &amp; borrowing platforms, tokenized assets, and analytic data platforms (e.g., CER.live, DefiLlama).</li><li><strong>Tools &amp; Infrastructure</strong>. The track covers all projects in categories of wallets, cross-border payments, subscription services, storage solutions, oracles, payment solutions, and distributed ledgers.</li></ol>



<p></p>



<p><strong>Win monetary prizes</strong>. The winners of each track will get $30,000 in stablecoins and a free <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">Smart Contract Audit</a> by Hacken. Second and third places get $20,000 and $10,000, respectively. There’s more: monetary rewards for honorary mentions, NFTs, Venom tokens, and exciting prizes from partners.&nbsp;</p>



<p><strong>Livestream</strong>. Key aspects of the Hackathon will be live-streamed on YouTube, Binance Live, and Bilibili. This live streaming will showcase the depth of global talent building on the Venom blockchain, allowing you to see firsthand the cutting-edge innovations and cybersecurity solutions being developed.</p>



<p><strong>Workshops. </strong>Venom Hackathon is the best learning opportunity. It has dedicated five weeks to the most insightful workshops from top professionals in the industry. Hacken auditors will also play a part, but more on that later.</p>



<p><strong>Timeline and registration. </strong>The opening ceremony will occur on May 8, and the hackathon will run until June 10. Registration is already open.</p>



<p>The Venom Hackathon is a fantastic opportunity to compete for a total prize pool of $225,000, gain exposure to potential investors, and showcase your skills in a supportive and innovative environment. So, don't miss the opening ceremony on May 8, 2023, and join this exciting event!</p>



<h2>About Venom</h2>



<p>Venom Foundation is a rapidly growing blockchain platform that brings secure CBDCs and Web3 apps to emerging economies. Its ecosystem already has a bridge, non-custodian wallet (iOS/Android/browser extension), block scanner, node staking, and LP farming. Venom token ($VENOM) is also coming soon.</p>



<p>Venom is eyeing the launch of a stablecoin, derivatives exchange, metaverse, social messaging platform, NFT marketplace, and launchpad. Participating in Venom Hackathon is the best way for developers to have an impact on the existing and new products in the Venom platform.</p>



<h3>Venom x Hacken Partnership</h3>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
https://twitter.com/VenomFoundation/status/1628032662316220416?s=20
</div></figure>



<p>On February 21, 2023—after months of cooperation as part of the audit process—Venom and Hacken announced a partnership aimed at creating a safer and more accessible blockchain ecosystem for all.</p>



<p>Hacken has decided to participate in Venon Hackathon to help promising developers build on top of the best security practices. Driven by the mission of making Web3 safer, we are ready to share our knowledge and expertise with the growing Venom ecosystem.&nbsp;</p>



<h2>Hacken’s Presence at Venom Hackathon</h2>



<p><strong>Hacken’s Lead Smart Contract Auditor as a Judge</strong>. Are you excited to showcase your skills in the upcoming Venom Hackathon? Here's another reason to be thrilled: Noah Jelich, the Lead Smart Contract Auditor at Hacken, will be one of the judges for the event.</p>



<p><strong>Get Ready for Noah’s Workshop</strong>. In addition to the judging role, Noah will also conduct a workshop on <em>Test-Driven Smart Contract Development</em>, which will cover the best practices for writing secure code, common vulnerabilities to watch out for, and tools and techniques for testing and debugging your contracts.</p>



<h3>About Noah Jelich, Judge from Hacken</h3>



<p><a href="https://www.linkedin.com/in/njelich/">Noah Jelich</a> is a Lead Security Auditor at Hacken (Solidity &amp; Rust). Since joining Hacken in 2022, Noah has already made an impact by detecting dozens of unique vulnerabilities in 30+ projects. Before joining Hacken, Noah worked as a Blockchain Developer at Ethereum Network. He has years of experience as a Full Stack Developer, several olympiad &amp; hackathon wins, and a degree in Theoretical Physics. Noah credits his remarkable achievements to his quick learning superpower. He is passionate about ML research for vulnerability detection and contributes to open-source projects. </p>



<h3>See you at Venom Hackathon</h3>



<p>The Hacken team looks forward to seeing you at the Venom Hackathon and encourages you to spread the word to other blockchain developers who may be interested. Don't miss this fantastic opportunity to learn, collaborate, and win!</p>

Venom Hackathon Announcement; Hacken as a Judge

<p class="has-medium-font-size"><strong>?Morpheus.Network and its smart contracts were never hacked or breached or put at any risk.</strong></p>



<p><strong>Tldr; Our partners from Morpheus.Network have stumbled upon a sophisticated phishing scheme on BSC involving a fake token. The Hacken team assisted by providing expert technical analysis. Through close collaboration, we managed to expose the unusually complex scam. </strong></p>



<p>Cryptocurrency security is crucial as cryptocurrencies operate on a decentralized network, meaning no central authority oversees transactions or monitors user activity. This decentralized structure opens up possibilities for malicious actors to exploit vulnerabilities in the system, such as hacking into an individual's cryptocurrency wallet or conducting fraudulent transactions.</p>



<p>Additionally, cryptocurrency transactions are irreversible, making it nearly impossible to recover funds once transferred to a scammer's wallet. Therefore, it is essential to prioritize security measures to safeguard against fraudulent activity and protect one's cryptocurrency.</p>



<p>Taking a proactive approach against scammers is vital to mitigate the risks associated with cryptocurrency. Scammers often employ sophisticated tactics to gain access to individuals' wallets or convince them to send cryptocurrency in exchange for false promises. Therefore, it is critical to stay informed about the latest scamming techniques and be vigilant in identifying potential scams.</p>



<p>This includes using reputable exchange platforms, utilizing secure wallets with two-factor authentication, and staying cautious of unsolicited emails or social media messages requesting cryptocurrency transfers. By staying informed and taking proactive measures, investors can minimize the risk of falling victim to fraudulent activity and help maintain the integrity of the cryptocurrency ecosystem.</p>



<p>Morpheus.Network is a company that has displayed a commitment to protecting its community, clients, and users. It has taken a proactive approach against online scams and shut down malicious websites targeting cryptocurrency users.</p>



<p>Everyone’s safety is everyone’s business, and through thoughtful and innovative coordination, we can make crypto the safest financial system on earth - through technology, agile governance, and education. There’s a crucial need for greater industry collaboration to enhance security. The future success of the entire industry depends on it.</p>



<p>Recently Morpheus.Network approached Hacken to collaborate on an investigation into some seemingly malicious activity on the Binance Smart Chain (BSC), which included creating a fake MNW cryptocurrency token.</p>



<h2>Crypto Scams Continue To Increase in Complexity</h2>



<p>According to <a href="https://www.google.com/search?client=safari&amp;rls=en&amp;q=crypto+crime+report+2023&amp;ie=UTF-8&amp;oe=UTF-8">Chainalysis</a>, crypto scam revenue hit $5.9 Billion in 2022. More money is lost in scams than hacks ($3.8B stolen in 2022). Scams are becoming more complex due to advancements in AI and new levels of sophistication. The case of the Fake MNW token proves that.</p>



<p>Here, the bad actor used spoofing. Instead of making a fake website or extension, the attacker took things one step further: copycatting a fake smart contract, generating a similar-looking address, and adding malicious functionality to appear as an official deployer address.</p>



<h2>What Happened?<br></h2>



<p>Recently Morpheus.Network approached Hacken to collaborate on the investigation into seemingly malicious activity on the Binance Smart Chain (BSC), which included creating a fake MNW cryptocurrency token.</p>



<p>The official Morpheus.Network (MNW) token smart contract is:<br><a href="https://etherscan.io/token/0xd3e4ba569045546d09cf021ecc5dfe42b1d7f6e4">https://etherscan.io/token/0xd3e4ba569045546d09cf021ecc5dfe42b1d7f6e4<br><br></a>At first, it looks as if the official ETH MNW smart contract deployer created a second fake MNW token on the Binance Smart Chain (BSC).&nbsp;</p>



<figure class="wp-block-image"><img src="https://lh5.googleusercontent.com/UPtv5sbua6k0jBvNd8otiVJHVXXdTq-XHSzp6aKxI92sVtU7rLqSzWx5scWbU13wUC3MAO7VBKW2RKxIGj0Zu1_YpQyygiupcBjMiJJpzYZwDIeY9dGdwey1C3kup6QYwOl_Zmadyq_1z6yG3GHRY5A" alt=""/></figure>



<p>However, upon further investigation, Hacken discovered a sophisticated phishing method, which was used to create a fake copycat version of the MNW token. This copycat token was later sold on PancakeSwap.</p>



<p>After closer inspection and detailed transaction review, we concluded that the actual sender is another address, not related to the MNW deployer address.&nbsp;</p>



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/cDjLSsAIM_C4a8LKfSMiZQMIZGSSjZCe9d6eqF04iMaCaaDRWrniN3ASQoKdGCqCw-5XSYK40IFjiDXV-uFf7irIZC4x5i2tAfeG4Xmna3QsrWMBHmKsg7cnjhVcthv1x1GhSd3znsbnGjM8YuTOuOU" alt=""/></figure>



<p>The official MNW deployer address is [0xc6214f77387d95d134C62E0d33Cd6a0D97aEe7c4], while the address from which the transactions were performed is [0xc3ca1c8075595d1dfd1baabc324ba7b988c9e476].</p>



<h3>How did the phisher make transactions look like they were sent from the original deployer address?</h3>



<p>The phisher used a <em>transferFrom</em> function in the malicious MNW contract they created. The fake MNW contract was hidden in the Context contract and contained a function called "safeTransfer" designed to perform the <em>transferFrom</em> function.&nbsp;</p>



<p><img width="624" height="25" src="https://lh5.googleusercontent.com/euTyDrrxpj56vOtY9KQ4370gF-DFM4Yc8TUBYxZhfKzS_F2OE5XQgk0KCnLs-lBJ46BDIx1l_8SYdzyYX3NnYMBpfRaowlsx4k67JSTm0DMRH-5TyfWQnAONOIL5qm7U-if5DuCs1UyQoHgSHCFPpd0"></p>



<p>Also, notice it was added as a single line and doesn’t follow conventional formatting. In the TransferHelper library:</p>



<p><img width="624" height="251" src="https://lh6.googleusercontent.com/vsyoSxhUgM9aYgZ2DlvVEbsB4pgNRowEviE89kjCdx6w1Gnd2jZdBIE82kU103jZm3QlSG0Y-wXvL_ndXyQ-nWp9OYSTHx08xNJGz0ozIE8VysezKWkTHCkO6Ke6baJZtmeXd5SsXGMGscPR9Fze0rc"></p>



<p>The reason why transfer events are found on Bbscscan.com is due to the usage of the <em>MOON.transferFrom()</em> function, which ultimately leads to the execution of <em>Context.safeTransfer()</em>. If this function returns false, the allowance checks in the original <em>transferFrom()</em> are skipped, allowing the <em>from</em> field to be forged. This is evident when the sender is 0xe15C1a6D4c72711876fAb0BaED69b83da3Bb0d5E.</p>



<p>For the other callers, <em>TransferHelper.safeTransferFrom()</em> is invoked, which forwards the <em>transferFrom()</em> call (with matching signature) to an already self-destroyed contract, 0x600Ca57B937a28Eb3012ED00D82688A09D365cEa.</p>



<p>In this way, the phisher was able to make it appear as if transactions were performed by the official deployer address, when in fact, they were done by the phisher's address and tricky contract.</p>



<p>Moreover, the attacker created a similar phishing smart contract address using the vanity tool:</p>



<p class="has-text-color" style="color:#17c917">ETH (original): 0xd3e4ba569045546d09cf021ecc5dfe42b1d7f6e4</p>



<p class="has-vivid-red-color has-text-color">BSC (created by phisher): 0xd3E4Aa07f00eA53Ac4A122f1356f1A355025F6e4</p>



<h3>How did the attacker create a similar address?</h3>



<p>The attacker likely used a vanity address generator to create a similar-looking address that could be easily mistaken for the original address. Vanity address generators work by generating a large number of random private keys and then calculating the corresponding public keys until one is found that matches a specific pattern or phrase.</p>



<p>In this case, the attacker may have used a vanity address generator to generate a private key, resulting in a public address similar to the original address but with a few characters changed. By doing this, the attacker could trick people into sending cryptocurrency to the fake address, thinking they were sending it to the original address.</p>



<h2>Lessons Learned</h2>



<p>This case demonstrates that you must be extra vigilant against scammers. This includes carefully checking and double-checking every smart contract and wallet address. Scammers can now create convincing token clones that look legitimate at first sight and make smart contracts appear as if deployed from official addresses.</p>



<p>With the availability of vanity tools, it is important to check not only the first and last digits of an address but the entire address. Many wallets, such as Metamask, have a built-in address book so you can safely store known wallet addresses.&nbsp;</p>



<p>Hacken and Morpheus.Network encourages more industry collaboration, knowledge sharing, and joint research to help make Blockchain the safest financial system on earth!!<br><br>Please be safe out there and keep yourself informed!</p>



<h2>About Morpheus</h2>



<p><a href="https://morpheus.network/links/">Morpheus.Network</a> is intensely focused on helping companies and government organizations remove barriers to digitize, optimize and automate their global supply chain operations. They help clients maximize revenue through digitization and process automation, protecting sensitive data, and untangling complex issues with the legacy supply chain system while delivering effective, equitable, and efficient global trade solutions.<br><br>All official Morpheus.Network links can be found here: <a href="https://morpheus.network/links/">https://morpheus.network/links/</a></p>



<h2>About Hacken</h2>



<p>Hacken is a Trusted Blockchain Security Auditor with a mission to make Web3 safer by contributing to security standards. In 5+ years, we have audited 1,200 Web3 projects and, in 2022, reached the significant milestone of zero exploits among audited projects.</p>



<p>Hacken team of 147 talents, including 60+ certified engineers, provide high-quality solutions at every level of blockchain security, including smart contract audits in Solidity, Vyper, Rust, and Move; dApp audits in JavaScript, Java, and Rust; penetration testing for web/iOS/Android apps and networks, and blockchain protocol audits.</p>



<p>Our product portfolio includes HackenProof bug bounties, CER.live cybersecurity ranking, and Hacken Extractor on-chain monitoring. As a contributor to EEA EthTrust Security Levels Specification, member of top industry organizations, and trusted security partner of 180+ Web3 projects, we continue to raise the bar for blockchain security.<br></p>

Get our latest updates and expert insights on Web3 security