Nomad, Solana hacks show DeFi’s inherent flaw

Crypto’s ‘hack me’ sign

You’d think after the crypto market shed $2 trillion in value in the last eight months, hackers might move on to more promising targets. But even a smaller market is providing tempting prey. News that criminals made off with $190 million after hacking the Nomad crypto bridge protocol was followed by Solana reporting that unknown attackers had drained more than 7,500 wallets of about $4 million worth of crypto tokens.

Bad code leads to bad outcomes. The Nomad and Solana breaches were “perpetrated through vulnerabilities in the coding of a contract and the software on which wallets run,” said Michael Fasanello, chief compliance officer at LVL.

• Experts blame the Nomad hack on a flawed update which created an opening for hackers, making it easy to simply copy and paste transactions with a new address to access tokens.
• The Nomad attack exemplified the problems with crypto bridges, which have come under increasing attack in recent years. They play an important role in crypto, but have also served as a weak link that hackers routinely exploit.

• The Solana hack involved a “cohort of wallets” which were “compromised in the breach,” according to Slope Finance, whose software enables Solana users to access their wallets. Phantom Wallet, a popular Solana wallet, also pointed to Slope.

Crypto has turned into a hacker’s paradise. Sam Curry, chief security officer at Cybereason, said the recent attacks show how hackers now have “a plethora of tools” to take on a space with “poor cyber standards” and “high value and fungible targets.”

• New crypto ventures are particularly attractive to hackers since they practically “have a ‘hack me’ sign outside,” Curry told Protocol. “The typical startup mentality of getting the code out there and fixing it on the fly is a recipe for disaster — and isn’t acceptable.”
• Nomad raised $22 million in April and recently touted its high-profile investors along with its goal to “create a safer crypto ecosystem.”
• Blockchain technology and cryptocurrencies promise a new financial system where users have complete control, free from intermediaries like banks and regulators, and transactions are totally transparent. But that also means there are few protections. The Nomad and Solana hacks highlight how, in DeFi, “there are few arbiters of the space beyond a project’s customer base, and the group in charge of running the project,” Curry said.
• DeFi proponents argue that having open-source code and many eyes on transactions serve as safeguards, but how well is that working out in practice?

It’s ironic, then, but centralized crypto exchanges — CeFi — are looking safer for customers willing to compromise their DeFi ideals. There’s a real “disparity in security” between DeFi and CeFi, Fasanello said. In crypto, “no individual or party [is] 100% responsible for security.” Fasanello isn’t sure DeFi can ever be made 100% secure. Buyer beware, hacker rejoice.

— Benjamin Pimentel (email | twitter) and Tomio Geron (email | twitter)

SPONSORED CONTENT FROM SOUL MACHINES

They created Digital People. Now they’ve made celebrities available as Digital Twins: Soul Machines co-founder and CEO Greg Cross and his co-founder Mark Sagar, Ph.D., FRSNZ are leading their Auckland and San Francisco-based teams to create AI-enabled Digital People to populate the internet, at first, and soon the metaverse.