{"id":8530,"date":"2023-08-06T11:27:00","date_gmt":"2023-08-06T11:27:00","guid":{"rendered":"https:\/\/www.trustrecipe.in\/?p=8530"},"modified":"2023-09-27T08:02:13","modified_gmt":"2023-09-27T08:02:13","slug":"multichain-security-breach-july-7-2023-detailed-analysis","status":"publish","type":"post","link":"https:\/\/immunebytes.com\/blog\/multichain-security-breach-july-7-2023-detailed-analysis\/","title":{"rendered":"Multichain Security Breach – July 7, 2023 – Detailed Analysis"},"content":{"rendered":"\n
The DeFi sector faced a major setback with a security breach in Multichain, previously known as Anyswap. <\/p>\n\n\n\n
On July 7, 2023, the hackers illicitly transferred vast sums from several token bridges, totaling approximately $126 million across chains like Fantom, Moonriver, and Dogecoin.<\/p>\n\n\n\n
This incident, which ranks as the 14th largest crypto theft in history, not only underlined vulnerabilities in Multichain but also destabilized other ecosystems reliant on it. <\/p>\n\n\n\n
The repercussions were felt with the de-pegging of stablecoins and affected ecosystems, even as investigations continue and the community hopes for asset recovery through potential negotiations with the hacker.<\/p>\n\n\n\n
Introduction<\/h3>\n\n\n\n
The DeFi sector has been rocked by a considerable security breach involving Multichain, a prominent cross-chain protocol formerly known as Anyswap. <\/p>\n\n\n\n
A staggering sum of ~$126M was unlawfully siphoned from multiple token bridges, raising serious questions about cross-chain transaction security. <\/p>\n\n\n\n
Some suspect it to be a rug pull, while some are of the opinion that the Lazarus group of North Korean hackers can be behind the hack.<\/p>\n\n\n\n
Timeline and Details of the Breach<\/h3>\n\n\n\n
Early Indications & Team’s Response:<\/h4>\n\n\n\n
Anomalies in Multichain’s contracts were the primary indicators of the exploit. Approximately $130 million in assets were shifted to an unknown account.<\/li>
On July 7th<\/strong>, hackers targeted Multichain, resulting in a theft of $126 million across chains like Fantom, Moonriver, and Dogecoin. This theft represented roughly 9% of the Total Value Locked (TVL) before the breach, making it the 14th largest theft in crypto history.<\/li><\/ul>\n\n\n\n
Timeline<\/strong><\/p>\n\n\n\n
4:21 PM UTC: First Suspicious transaction detected. Txn: https:\/\/bit.ly\/3O5vBzL<\/li>
6:33 PM UTC: ~30M WBTC and assets withdrawn from MultiChain bridge. Txn: https:\/\/bit.ly\/3D2q9an<\/li>
7:35 PM UTC: LayerZero confirms no direct involvement in the hack.<\/li>
Other bridges hit were Multichain’s Moonriver and Dogecoin contracts. The total assets stolen from Multichain Bridge amounted to $126.3 million.<\/p>\n\n\n\n
Addresses Linked to the Breach<\/h3>\n\n\n\n
\n
0x9d5765ae1c95c21d4cc3b1d5bba71bad3b012b68 \u00e2\u20ac\u201d ($16.7M including DAI, LINK, USDT, and CRV)<\/li>
0xefeef8e968a0db92781ac7b3b7c821909ef10c88 \u00e2\u20ac\u201d $30.1M in USDC<\/li>
0x418ed2554c010a0c63024d1da3a93b4dc26e5bb7 \u00e2\u20ac\u201d $13.4M in wETH<\/li>
0x622e5f32e9ed5318d3a05ee2932fd3e118347ba0 \u00e2\u20ac\u201d $30.9M in wBTC<\/li>
0x48bead89e696ee93b04913cb0006f35adb844537 \u00e2\u20ac\u201d $7.5M in USDC, USDT, DAI, and wBTC from Moonriver<\/li>
0x027f1571aca57354223276722dc7b572a5b05cd8 \u00e2\u20ac\u201d $27.7M in USDC<\/li><\/ul>\n\n\n\n<\/figure>\n\n\n\n
The Aftermath of the Exploit<\/h2>\n\n\n\n
On July 14th, an update was provided. The CEO, Zhaojun, was detained by Chinese authorities, leading to loss of access to vital operational servers and funds. Subsequent issues, including Zhaojun’s sister’s detainment, compounded the crisis.<\/li>
The team has since urged users not to use the Multichain service and to amplify this message.<\/li><\/ul>\n<\/div><\/div>\n\n\n\n
The Impact on Other Ecosystems<\/h3>\n\n\n\n
Direct and Ripple Effects<\/h4>\n\n\n\n
Stablecoins on Fantom, Moonriver, and Dogechain have suffered severe de-pegging. On Fantom: fUSDC is now at $0.56, fUSDT at $0.39, and fDAI at $0.38.<\/li>
Kava, Conflux, and ETHW, though not directly affected by the hack, are facing stability issues due to reliance on cross-chain assets issued by Multichain.<\/li>
Many DEFI whales on Fantom are converting their assets into FTM and depositing them into exchanges, exacerbating the de-pegging of stablecoins on Fantom.<\/li><\/ul>\n\n\n\n
Historical Perspective<\/h3>\n\n\n\n
Multichain, previously Anyswap, has suffered multiple attacks in the past. An approval-draining attack in 2022 led to a loss of $3 million. This recent exploit is among the most severe attacks of July 2023.<\/li>
The massive thefts from Ronin Network in 2022 and Poly Network in 2021 underscore the risks associated with the cross-chain bridges. It’s also worth noting the North Korean group Lazarus have been allegedly involved in several attacks,<\/li>
While Multichain once declared itself a \u00e2\u20ac\u0153leader in terms of security,\u00e2\u20ac\u009d it now stands as a testament to the unpredictable and high-risk nature of the cryptocurrency industry.<\/li><\/ul>\n\n\n\n
Investigation & Current Status<\/h3>\n\n\n\n
The suspected cause of the breach is a loss of control over the MPC address by the Multichain team. As of now, there’s no definitive explanation.<\/li>
Circle, the issuer of USDC, froze $63 million linked to the breach.<\/li><\/ul>\n\n\n\n
Positive Aspects & Future Prospects<\/h3>\n\n\n\n
Assets worth 63.2 million USDC and 2.53 million USDT have been frozen by Circle and Tether within 24 hours of the incident.<\/li>
The stationary nature of the stolen funds suggests potential negotiations with the hacker, possibly allowing for some asset recovery.<\/li><\/ul>\n\n\n\n
Precautionary Measures<\/h3>\n\n\n\n
Users should verify the status of cross-chain bridges through official channels and project explorers before initiating transactions.<\/li>
Approve only intended transfer amounts and ensure investments remain within an acceptable loss range.<\/li>
In case of future breaches, revoke contract authorizations swiftly and liaise with project teams.<\/li><\/ul>\n\n\n\n
Conclusion<\/h3>\n\n\n\n
The Multichain breach highlights the inherent vulnerabilities of cross-chain bridges in the evolving cryptocurrency landscape.
![\"\"](\"https:\/\/www.trustrecipe.in\/wp-content\/uploads\/2023\/08\/multichain-hack-July-7-2023-1024x481.png\")
<\/figure>\n\n\n\n