BEANSTALK SECURITY BREACH...Latest Articles TODAY | Bleeping Computer

A post-mortem analysis of the attack from smart contract auditors and developers at Omniscia explains that the hacker managed to steal the assets via a malicious proposal. . .

What happens now 

Beanstalk hasn't shared its plans moving forward, so reimbursing the investors remains an uncertain action.

"We believe there is a need to educate and inform non-technical market participants about the status, scope and limitations of technical audits. Our team is currently working on multiple initiatives aimed at demystifying audits," reads the analysis.

> The platform is still investigating the incident and has openly called the DeFi community and blockchain analytics experts to help them salvage what they can. At the same time, it has also invited the exploiter to negotiate.

. . .Interestingly, PeckShield blockchain analytics reports that the hacker has donated $250,000 of the stolen amount to Ukraine.

 

Beanstalk DeFi platform loses $182 million in flash-loan attack

Bill Toulas

BleepingComputer |

"The decentralized, credit-based finance system Beanstalk disclosed on Sunday that it suffered a security breach that resulted in financial losses of $182 million, the attacker stealing $80 million in crypto assets.

As a result of this attack, trust in Beanstalk's market has been compromised, and the value of its decentralized credit-based BEAN stablecoin has collapsed from a little over $1 on Sunday to $0.11 right now.

The drop in BEAN's value within a day(CoinGecko)

. . .

Essentially, the attacker allowed themselves to drain all of the protocol's funds to a private Ethereum wallet in an instance, having the power to vote in favor of the action.

A flash loan allows users to borrow a large amount of stablecoins from other traders without offering a collateral (unsecured) and the process of approving a loan and returning it happens in a single transaction on the blockchain, within seconds.

DeFi platforms under fire

A Chainalysis report from last week indicates that DeFi platforms are the primary focus of crypto-heists in 2022, and the Beanstalk incident is yet another confirmation of this trend.

Typically, these hacks occur either via a security breach or an exploit in the code, so flash-loan attacks are likely to became less frequent.

LATEST ARTICLES https://www.bleepingcomputer.com/

• 
  Security

  CISA warns of attackers now exploiting Windows Print Spooler bug

  The Cybersecurity and Infrastructure Security Agency (CISA) has added three new security flaws to its list of actively exploited bugs, including a local privilege escalation bug in the Windows Print Spooler.

  • Sergiu Gatlan
  • April 19, 2022
  • 06:08 PM
  • 0
• 
  Security

  Emotet botnet switches to 64-bit modules, increases activity

  The Emotet malware is having a burst in distribution and is likely to soon switch to new payloads that are currently detected by fewer antivirus engines.

  • Bill Toulas
  • April 19, 2022
  • 03:57 PM
  • 0
• 
  Security

  QNAP urges customers to disable UPnP port forwarding on routers

  Taiwanese hardware vendor QNAP urged customers on Monday to disable Universal Plug and Play (UPnP) port forwarding on their routers to prevent exposing their network-attached storage (NAS) devices to attacks from the Internet.

  • Sergiu Gatlan
  • April 19, 2022
  • 03:38 PM
  • 0
• 
  Microsoft, Security

  Microsoft disables SMB1 by default for Windows 11 Home Insiders

  Microsoft announced today that the 30-year-old SMBv1 file-sharing protocol is now disabled by default on Windows systems running the latest Windows 11 Home Dev channel builds, the last editions of Windows or Windows Server that still came with SMBv1 enabled.

  • Sergiu Gatlan
  • April 19, 2022
  • 02:30 PM
  • 1
• 
  Deals

  This note-taking software deal helps organize your notes across time

  Note-taking will be part of any role, and organized notes you can export and search make work easier. Agenda Premium 14 makes your notes actionable for $9.99, 71% off the $34 MSRP.

  • BleepingComputer Deals
  • April 19, 2022
  • 02:11 PM
  • 0
• 
  Security

  Real-time voice concealment algorithm blocks microphone spying

  Columbia University researchers have developed a novel algorithm that can block rogue audio eavesdropping via microphones in smartphones, voice assistants, and IoTs in general.

  • Bill Toulas
  • April 19, 2022
  • 01:37 PM
  • 1
• 
  Security

  GitHub notifies owners of private repos stolen using OAuth tokens

  GitHub says it notified all organizations believed to have had data stolen from their private repositories by attackers abusing compromised OAuth user tokens issued to Heroku and Travis-CI.

  • Sergiu Gatlan
  • April 19, 2022
  • 12:55 PM
  • 0
• 
  Security

  Sponsored Content

  How to protect your ADFS from password spraying attacks

  Microsoft recommends a multi-tiered approach for securing your ADFS environment from password attacks. Learn how Specops can fill in the gaps to add further protection against password sprays and other password attacks.

  • Sponsored by Specops
  • April 19, 2022
  • 10:00 AM
  • 0
• 
  Security

  New stealthy BotenaGo malware variant targets DVR devices

  Threat analysts have spotted a new variant of the BotenaGo botnet malware, and it's the stealthiest seen so far, running undetected by any anti-virus engine.

  • Bill Toulas
  • April 19, 2022
  • 09:34 AM
  • 0
• 
  Security

  Lenovo UEFI firmware driver bugs affect over 100 laptop models

  Lenovo has published a security advisory on vulnerabilities that impact its Unified Extensible Firmware Interface (UEFI) loaded on at least 100 of its laptop models.

  • Ionut Ilascu
  • April 19, 2022
  • 09:01 AM
  • 3
• 
  Deals

  Virtually design circuits with this KiCad training bundle deal

  Electronic engineering can be as frustrating as it is rewarding, and KiCad helps take some of the frustration out of the work. The KiCad Like a Pro 3rd edition Ebook + Course Bundle helps you get the most from it for $46.99, a 30% discount off the $67 MSRP.

  • BleepingComputer Deals
  • April 19, 2022
  • 07:17 AM
  • 0
• 
  Security

  LinkedIn brand takes lead as most impersonated in phishing attacks

  Security researchers are warning that LinkedIn has become the most spoofed brand in phishing attacks, accounting for more than 52% of all such incidents at a global level.

  • Bill Toulas
  • April 19, 2022
  • 06:14 AM
  • 0