A hacker turned 25 cents of bitcoin into 46 billion fake BTC tokens on a DeFi bridge

A hacker turned 25 cents of bitcoin into 46 billion fake BTC tokens on a DeFi bridge

Özet: Kripto piyasasında önemli gelişmeler yaşanıyor.

Printing 46 billion fake bitcoin BTC$75,767.61-linked tokens on cross-chain application Symbiosis started with a deposit of just 330 satoshi, the smallest unit of bitcoin, worth about 25 cents in total.

The service lets users swap tokens across blockchains where they may not originally be supported.

A post-mortem published early Tuesday shows how two software flaws in the Symbiosis’ Bitcoin Bridge combined to let an attacker create enormous amounts of syBTC, a token meant to represent bitcoin held by the system.

Blockchain data reviewed by CoinDesk shows the attacker processed 12 bogus deposits across BNB Chain, Ethereum and Rootstock in roughly four minutes, eventually creating about 46.1 billion syBTC, or more than 2,000 times Bitcoin’s 21 million coin limit.

The bridge looked at the wrong part of a bitcoin transaction when deciding who had sent the money, allowing the attacker to persuade the system to treat them as both an approved depositor and the bridge administrator, according to Symbiosis.

That elevated access let the attacker push the bridge’s minimum fee below zero.

A second bug then subtracted the negative fee from the deposit amount, which added to it rather than reducing it — meaning the deposit could suddenly be treated as worth essentially whatever number the attacker supplied.

Symbiosis said syBTC supply stood at just 13.91 tokens before the attack, with 11.26 syBTC sitting in liquidity pools paired with WBTC, cbBTC, BTCB and RBTC.

Its preliminary estimate puts losses to liquidity providers and affected users at 9.97 BTC, or about $770,000.

The discrepancy between the number of tokens created and the actual loss stems from a feature of the process.

Analiz: Piyasa hareketliliği devam ediyor.