View source for AllBridge Malicious DNS Hijack

{{Case Study Under Construction}}[[File:Allbridge.jpg|thumb|AllBridge Homepage/Logo]]

== About AllBridge ==
Allbridge, founded in 2021, is a "[c]ross-chain solutions provider" which offers "[t]he most convenient cross-chain transfers"<ref name="allbridgewebsite-10528" /><ref name="allbridgedocs-10529" />. The service offers AllBridge Classic, Allbridge BaaS, and Allbridge Core<ref name="allbridgewebsite-10528" />.

<blockquote>"Allbridge is a simple, modern, and reliable way to transfer assets between different networks. It is a bridge between both EVM (Like Ethereum, Polygon, BSC) and non-EVM compatible (like Solana, Terra) blockchains, that aims to cover L2 (like Arbitrum, Optimism) solutions and NFT transfers in the future. Allbridge’s mission is to make the blockchain world borderless and provide a tool to freely move assets between different networks."

"Allbridge Classic is a generalized bridge between EVM and non-EVM compatible blockchains, supporting native and wrapped token transfers."

"Allbridge BaaS is a white-label bridging solution that supports Solana, NEAR, Tron, and all EVM chains. The product offers a simple, customizable UI, a flexible architecture setup, full ownership of smart contracts, and a validator."

"Allbridge Core enables the transfer of value between blockchains by offering cross-chain swaps of native stablecoins. Being messaging protocol agnostic, Allbridge Core connects a variety of EVM and non-EVM networks."</blockquote>

The AllBridge smart contracts had been audited by Hacken and was undergoing an audit by Kudelski Security<ref>[https://docs.allbridge.io/allbridge-overview/security AllBridge Security Overview - AllBridge Docs] (Feb 25, 2023)</ref><ref>[https://hacken.io/audits/#allbridge AllBridge Audit Performed by Hacken] (Feb 25, 2023)</ref><ref>[https://drive.google.com/file/d/1geBAoT0iuLy3s7EnlUBDKfXr-BwZWpHZ/view AllBridge Audit by Kudelski Security] (Feb 25, 2023)</ref><ref>[https://allbridge.medium.com/allbridge-successfully-completes-smart-contract-code-review-by-hacken-82e8497b1d2b Allbridge Successfully Completes Smart Contract Code Review By Hacken - AllBridge Medium] (Feb 25, 2023)</ref><ref name=":1">[https://allbridge.medium.com/kudelski-security-audit-completed-8483e6bc463e Kudelski Security Audit Completed - AllBridge Medium] (Feb 25, 2023)</ref>. AllBridge provides a list of all smart contract addresses on their website<ref>[https://docs.allbridge.io/allbridge-overview/bridge-contracts Bridge Contract Addresses - AllBridge Docs] (Feb 25, 2023)</ref><ref>[https://web.archive.org/web/20220527115116/https://docs.allbridge.io/allbridge-overview/bridge-contracts Bridge Contract Addresses on May 27th, 2022 - AllBridge Docs Archived] (Feb 25, 2023)</ref>.

Twitter:<ref>[https://twitter.com/Allbridge_io Allbridge Twitter Profile] (Dec 27, 2023)</ref>

Medium:<ref>[https://allbridge.medium.com/ Allbridge Medium Account] (Dec 27, 2023)</ref>
== The Reality ==
While the smart contract operates in a decentralized manner, most users will tend to interact with the contracts using transactions generated by a centralized website. When a domain name is accessed on the internet, a service called DNS is used to point the domain name to an IP address<ref name="cloudflarewhatisdns-10527" />.

The AllBridge project used NameCheap for their registrar for their primary website<ref name="convexpostmortem-8882" />. The procedures at NameCheap were such that support team members were able to override the DNS of the website to point the domain name to a malicious server<ref name="convexbacktonormaltwitter-8885" /><ref name="devancollins3replytwitter-8894" /><ref name="lefterisjptwitter-10565" />.

== What Happened ==
After breaching the credentials of a NameCheap customer support agent<ref name="namecheapceotwitter1-8884" /><ref name="namecheapceotwitter3-10566" />, an attacker modified the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack|Ribbon Finance]], [[DeFi Saver Malicious DNS Hijack|Defi Saver]], and AllBridge<ref name=":7">[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2023)</ref> to point to a phishing server with a similar front-end. This front-end requested approval for a smart contract with the same first and last 4 characters as the official smart contract address of Convex Finance<ref name="stefanpatatutwitter-8881">[https://twitter.com/StefanPatatu/status/1522570166890119173 Stefan Patatu - "What are vanity addresses? How can haxxors use them to steal your coins? How can dapps use them to protec you? What can wallets do to protec you? What can you do to protec yourself? A thread on some obscure knowledge, on things you don’t know you don’t know." - Twitter] (Aug 23, 2022)</ref>, and could drain funds from the wallets of any approving users.
{| class="wikitable"
|+Key Event Timeline - AllBridge Malicious DNS Hijack
!Date
!Event
!Description
|-
|March 22nd, 2022
|Domain Vault Announced
|The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon"<ref name="namecheapdomainvault1-10530" />.
|-
|June 20th, 2022 3:05:42 AM
|First Malicious Contract Creation
|The very first smart contract is created by a wallet controlled from the attacker<ref name=":03">[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First Transaction Creating Malicious Contract 0x65a8...3b2f - Etherscan] (Feb 23, 2023)</ref>. Malicious contract 0x65a8...3b2f<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref> was created by wallet 0x5622...781a<ref name=":03" /><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref>.
|-
|June 20th, 2022 9:01:35 AM
|First Spoof Contract of AllBridge
|The very first smart contract (0xbbbd2ed360dac9f6e005fc6a4398d7d6beabe884) is created<ref>[https://etherscan.io/tx/0x24c4e13b768ba2439e8b0f92b7552e5eff21bf88b3f0f20a5b8949dcb9ceba96 First AllBridge Spoof Contract - Etherscan] (Feb 25, 2023)</ref> that spoofs AllBridge's bridge contract (0xBBbD1BbB4f9b936C3604906D7592A644071dE884)<ref name=":2">[https://etherscan.io/address/0xBBbD1BbB4f9b936C3604906D7592A644071dE884 AllBridge's Bridge Contract - Etherscan] (Feb 25, 2023)</ref>. There is no evidence that anyone interacted with this contract<ref>[https://etherscan.io/address/0xbbbd2ed360dac9f6e005fc6a4398d7d6beabe884 No Interaction With First Spoof Contract - Etherscan] (Feb 25, 2023)</ref>.
|-
|June 20th, 2022
|Domain Vault Launches
|The NameCheap "Domain Vault" service now switches from "Get early access" to "Get Domain Vault" with the price remaining at $19.88/mo<ref name="namecheapdomainvault2-10567" /><ref name="namecheapdomainvault3-10568" />.
|-
|June 21st, 2022 7:34:43 AM MDT
|AllBridge New Chapter
|AllBridge publishes their "AllBridge: The New Chapter" to their Medium<ref>[https://allbridge.medium.com/allbridge-the-new-chapter-59988c0c625c AllBridge: The New Chapter - AllBridge Medium] (Feb 25, 2023)</ref> and shares its plans for the second year of its journey via a link on Twitter<ref>[https://twitter.com/Allbridge_io/status/1539240645201735682 @Allbridge_io - "share our vision of the new generation of #crosschain transfers" - Twitter] (Feb 25, 2023)</ref>. Since its mainnet launch in July 2021, over $6.2 billion has been bridged across 14 different networks. The platform aims to add at least five new blockchains by the end of 2022. Allbridge introduces a new bridge architecture focusing on simplicity and one-click cross-chain transfers of native tokens. The new bridge will support stablecoin transfers and prioritize select chains and assets. It emphasizes decentralization and non-custodial solutions, with non-upgradeable contracts and audits for security. The bridge's future roadmap includes the release of an MVP for internal usage in the next few weeks, with the product beta targeted for early autumn. The existing Allbridge V1 will continue to offer versatile cross-chain transfers. The ABR token will retain its utility in governance and rewards systems for both projects. It is unknown whether the DNS breach had yet occurred when this was posted.
|-
|June 21st, 2022 7:13:11 PM
|Second Spoof Contract of AllBridge
|A second smart contract (0xbbbd89e4cd6c0ac07f164b84546b6439d415e884) is created<ref>[https://etherscan.io/tx/0x3bf43544cbe1524968c01f18735f1fe091dbe71229bc5ddb9740deba9489b113 Second Spoof Smart Contract Created - Etherscan] (Feb 25, 2023)</ref> that spoofs AllBridge's bridge contract (0xBBbD1BbB4f9b936C3604906D7592A644071dE884)<ref name=":2" />. There is no evidence that anyone interacted with this contract<ref>[https://etherscan.io/address/0xbbbd89e4cd6c0ac07f164b84546b6439d415e884 No Interaction with Second Spoof - Etherscan] (Feb 25, 2023)</ref>.
|-
|June 22nd, 2022 8:29:00 AM
|AllBridge Unrelated Tweet
|An unrelated tweet to "[c]heck out the cool updates to @MercurialFi's Dynamic Yield Layer."<ref>[https://twitter.com/Allbridge_io/status/1539616624071917569 @Allbridge_io - "Check out the cool updates to @MercurialFi's Dynamic Yield Layer." - Twitter] (Feb 25, 2023)</ref> suggests that AllBridge still hadn't been breached yet or was unaware of any attack.
|-
|June 23rd, 2022 3:28:00 AM
|Final Spoof Contract of AllBridge
|A third smart contract (0xbbbd216c0334a9e4ce7d0acde5189b5548e3e884) is created<ref>[https://etherscan.io/tx/0x3459fc735a6bae2e9c8ab54bfb25bf093b53a0392b8e3d4e3336e0e119ccc612 Final Spoof Contract Creation - Etherscan] (Feb 25, 2023)</ref> that spoofs AllBridge's bridge contract (0xBBbD1BbB4f9b936C3604906D7592A644071dE884)<ref name=":2" />. There is also no evidence that anyone interacted with this contract<ref>[https://etherscan.io/address/0xbbbd216c0334a9e4ce7d0acde5189b5548e3e884 No Interactions With Final Spoof - Etherscan] (Feb 25, 2023)</ref>.
|-
|June 23rd, 2022 6:00:00 AM
|AllBridge Aware of Breach
|AllBridge reports becoming aware that "in some cases bridge was requesting a second spend approval on the EVM chains" at "12:00 UTC"<ref>[https://twitter.com/Allbridge_io/status/1540305751058665472 @Allbridge_io - "in some cases bridge was requesting a second spend approval on the EVM chains" - Twitter] (Feb 25, 2023)</ref> and that it was "successfully solved in an hour after it was discovered"<ref name=":3">[https://twitter.com/Allbridge_io/status/1540305680044892161 @Allbridge_io - "we would like to disclose the results of our investigation" - Twitter] (Feb 25, 2023)</ref>.
|-
|June 23rd, 2022 6:17:41 AM
|Final Malicious Contract
|The final malicious smart contract is created by the attacker<ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Final Malicious Contract Creation - EtherScan] (Feb 23, 2023)</ref>.
|-
|June 23rd, 2022 7:39:00 AM
|Revoke Approvals Tweet
|AllBridge posts a Twitter notice requesting visitors to "revoke approvals given via our interface in the last 5 hours"<ref>[https://twitter.com/Allbridge_io/status/1539966444384813058 @Allbridge_io - "revoke approvals given via our interface in the last 5 hours" - Twitter] (Feb 25, 2023)</ref>.
|-
|June 23rd, 2022 1:02:00 PM
|Alexintosh Convex Finance Tweet
|The Twitter user @alexintosh reported an abnormal approval requested by the similarly affected Convex Finance website, with a similar but not exact smart contract address<ref name="alexintoshtwitter-8874">[https://twitter.com/Alexintosh/status/1540047636467748870 @Alexintosh Twitter] (Aug 23, 2022)</ref><ref name="convexcontractaddresses-8886">[https://docs.convexfinance.fi/convexfinance/faq/contract-addresses Contract Addresses - ConvexFinance] (Aug 24, 2022)</ref><ref name="cryptonomist-8870">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.
|-
|June 23rd, 2022 2:23:00 PM
|Please Review Approvals
|Convex Finance posts their very first announcement on Twitter, requesting users to "[p]lease review approvals while we evaluate a potential front end issue<ref name="convexfinancepleasereviewtwitter-8875">[https://twitter.com/ConvexFinance/status/1540068029920432128 @ConvexFinance - "Please review approvals while we evaluate a potential front end issue." - Twitter] (Aug 23, 2022)</ref>."
|-
|June 23rd, 2022 3:46:00 PM
|Additional Malicious Contracts
|Twitter user @HarukoTech describes several malicious contracts which were created against different protocols and that "[t]he attacker seems to be generating similar addresses to well know[n] protocols"<ref name="harukotechdifferentcontracts-8895">[https://twitter.com/HarukoTech/status/1540088990723969027 @HarukoTech Twitter] (Aug 24, 2022)</ref>.
|-
|June 23rd, 2022 3:54:00 PM
|Bret Woods Suggestion
|Twitter user Bret Woods (@fewture) posts that "[w]e're seeing hackers create addresses that match the first 4 and last 4 characters". His suggestion is to run the same transaction with "the gas SUPER LOW. Like 5 gwei. Your transaction won't go through, but it will populate on @etherscan where it is much easier to click through and make sure it's doing what you intended to do"<ref name=":0">[https://twitter.com/fewture/status/1540090921034940416 Bret Woods (@fewture) Guide - Twitter] (Feb 22, 2023)</ref>.
|-
|June 23rd, 2023 4:33:00 PM
|AllBridge Interface Notice
|AllBridge provides a new tweet announcing that "[t]he issue has been fixed and it's safe to transfer the assets"<ref name=":6">[https://twitter.com/Allbridge_io/status/1540100851708084224 Allbridge - "The issue has been fixed and it's safe to transfer the assets. Please verify the address and the contract that is being approved. The official list of contracts can be found here" - Twitter] (Dec 27, 2023)</ref> and requesting affected users to "revoke the approval they did for the bridge throughout the past week" and announces they've updated their interface with a revoke notice specifically targeting affected wallets<ref name=":8">[https://twitter.com/Allbridge_io/status/1540100791641456643 <nowiki>@Allbridge_io - "revoke the approval [you] did for the bridge throughout the past week" - Twitter</nowiki>] (Feb 25, 2023)</ref>.
|-
|June 23rd, 2022 4:46:00 PM
|Convex Finance DNS Hijack Post
|Similarly affected Convex Finance first posts on Twitter to announce the DNS hijacking. They list 5 addresses which are affected, that investigation is still ongoing, and that the issue is "remediated" for their service<ref name="convexannouncesdnshijacktwitter-8893">[https://twitter.com/ConvexFinance/status/1540104036229185536 @ConvexFinance Twitter] (Aug 24, 2022)</ref><ref name="cryptonomist-88702">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.
|-
|June 24th, 2022 5:58:00 AM
|Interest In Joining Forces
|Andriy responds to Convex Finance's tweet, reporting that the AllBridge protocol suffered the same attack, and enquiring about joining forces to find the responsible party<ref>[https://twitter.com/avelykyy/status/1540303352852013057 Andriy @avelykyy - "would be happy to to align efforts in finding the responsible party" - Twitter] (Feb 27, 2023)</ref>.
|-
|June 24th, 2022 6:02:00 AM
|Telegram Group Joined
|Andriy sends a DM to join a Telegram group with other affected protocols<ref>[https://twitter.com/avelykyy/status/1540304265780019204 Andriy @avelykyy - "DMd" - Twitter] (Feb 27, 2023)</ref><ref name=":4">[https://twitter.com/0xLlam4/status/1540303906215010304 0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.
|-
|June 24th, 2022 6:07:00 AM
|Twitter Investigation Results
|AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".<ref name=":3" /> They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"<ref>[https://twitter.com/Allbridge_io/status/1540306254920294400 <nowiki>@Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter</nowiki>] (Feb 25, 2023)</ref>.
|-
|June 24th, 2022 6:14:00 AM MDT
|All Attacks Reported Together
|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref name=":5">[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.
|-
|June 24th, 2022 7:00:00 AM MDT
|Attacks Reported With Screenshots
|Twitter user Nalin Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nalin Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
|-
|June 24th, 2022 7:24:00 AM MDT
|Speculation About Further Domains
|Further speculation arises that some other domains may be related<ref>[https://twitter.com/nalingupta01/status/1540325110720380928 <nowiki>Nalin Gupta - "It does seem some others might be affected tho[ugh]" - Twitter</nowiki>] (Apr 1, 2023)</ref>. The list referenced are cryptocurrency phishing websites and it does not appear that any of those domains are related to the DNS attack<ref>[https://twitter.com/idclickthat/status/1540200001112096768 idclickthat - "crypto phish" - Twitter] (Apr 1, 2023)</ref>.
|-
|June 24th, 2022 7:29:00 AM
|Attacks Reported Together Again
|Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.
|-
|June 24th, 2022 10:01:00 AM
|NameCheap Response
|NameCheap's CEO responds on Twitter that they've "traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."<ref name="namecheapceotwitter1-8884" />
|-
|June 24th, 2022 10:03:00 AM
|Free DomainVault Monitoring
|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.
|-
|June 24th, 2022 10:32:00 AM MDT
|Nothing To Worry About
|NameCheap assures via Twitter that "[t]here is nothing to worry about" and they will "keep investigating"<ref>[https://twitter.com/Namecheap/status/1540372203627216898 NameCheap - "There is nothing to worry about; we keep investigating" - Twitter] (Apr 1, 2023)</ref>.
|-
|June 24th, 2022 11:21:00 AM
|NameCheap DomainVault
|"Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand [DNS]. If you want complete security use [DomainVault]"<ref name="namecheapceotwitter2-8889" />
|-
|June 24th, 2022 4:16:00 PM
|NameCheap Clarifies Hack
|NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."<ref name="namecheapceotwitter3-10566" />
|-
|June 25th, 2022
|Domain Vault Discount
|NameCheap lowers the price of their Domain Vault service from $19.88/mo<ref name="namecheapdomainvault4-10569" /> to $1.88/mo<ref name="namecheapdomainvault5-10570" />.
|-
|June 26th, 2022 5:24:00 AM
|Tuvaru_Crypto Affected
|Twitter user @Tuvaru_Crypto responds that they "use[d AllBridge the] other day and have been away all weekend and now found [their] wallet drained<ref>[https://twitter.com/Tuvari_Crypto/status/1541019592327593984 @Tuvari_Crypto - "I use this site other day and have been away all weekend and now found my wallet drained" - Twitter] (Feb 25, 2023)</ref>".
|-
|June 26th, 2022 5:59:00 AM
|AllBridge Response To Tuvaru_Crypto
|AllBridge responds to request further information from Tuvaru_Crypto<ref>[https://twitter.com/Allbridge_io/status/1541028432234299392 @Allbridge_io - "send an email ... with a detailed description of this issue" - Twitter] (Feb 25, 2023)</ref>.
|-
|July 2nd, 2022
|Price Segmentation
|NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo<ref name="namecheapdomainvault6-10571" /> to "Titanium" tier at $19.88/mo<ref name="namecheapdomainvault7-10572" />.
|-
|July 8th, 2022 9:48:40 AM MDT
|Kudelski Security Audit
|AllBridge reports that an audit by Kudelski Security has been successfully completed. No mention of the DNS exploit is made in this post<ref name=":1" />. "The audit has now been completed, and it determined Allbridge’s contracts to be up to Kudelski’s standards and devoid of significant issues."
|}

== Technical Details ==
The account of a customer support agent for NameCheap<ref name="namecheapceotwitter1-88843">[https://twitter.com/NamecheapCEO/status/1540364576151289857 <nowiki>Richard Kirkendall - "traced this down to a specific [customer support] agent that was either hacked or compromised" - Twitter</nowiki>] (Aug 24, 2022)</ref> was believed to be hacked<ref name="namecheapceotwitter3-105663">[https://twitter.com/NamecheapCEO/status/1540458990831894532 <nowiki>Richard Kirkendall - "[l]ooks more like [their customer support] person was hacked." - Twitter</nowiki>] (Feb 11, 2023)</ref>.

This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including Convex Finance, [[Ribbon Finance Malicious DNS Hijack|Ribbon Finance]], [[DeFi Saver Malicious DNS Hijack|Defi Saver]], and [[AllBridge Malicious DNS Hijack|AllBridge]]<ref name=":72">[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. Because they were making the changes as an official support team member, the attacker was able to override any 2-factor authentication, passwords, and security alert settings in the account<ref>[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref><ref name=":5" />.

The domain names were modified to point to a server which displayed a similar website to Convex Finance, and requested the user to provide approval to vanity smart contracts which had the same first and last 4 characters as the official smart contract address of Convex Finance<ref name="stefanpatatutwitter-88812">[https://twitter.com/StefanPatatu/status/1522570166890119173 Stefan Patatu - "What are vanity addresses? How can haxxors use them to steal your coins? How can dapps use them to protec you? What can wallets do to protec you? What can you do to protec yourself? A thread on some obscure knowledge, on things you don’t know you don’t know." - Twitter] (Aug 23, 2022)</ref>.

Instead of function as the standard Convex Finance smart contract would, this new smart contract would enable the attacker to drain all of the user's funds from their wallet.

TBD - Sources need to be merged properly.

=== Blockchain Analytics ===
Various notable addresses and transactions from Etherscan for further research/analysis:

<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 Transaction Creating Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Transaction Creating 0xdd49....c82b - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/txs?a=0x56d3191ee65f1f76e4e902ec983c6420398d49c8 Transactions By Wallet 0x56d3...49c8 (Fake_Phishing5851) - Etherscan] (Dec 27, 2023)</ref><ref>[https://etherscan.io/address/0x4e1256734882c3deff95e963b6a0a658bb88899a Address 0x4e12...899a Who Created 0xf403...ae31 - Etherscan] (Dec 28, 2023)</ref><ref>[https://etherscan.io/address/0xf403a2c10b0b9fef8f0d4f931df5d86ad187ae31 Vanity Phishing Smart Contract 0xF403...AE31 - Etherscan] (Dec 7, 2o23)</ref><ref name="etherscanattackeraddress1-8877">[https://etherscan.io/address/0xb73261481064f717a63e6f295d917c28385af9aa Address 0xB732...F9Aa (Convex & Ribbon Phisher) - Etherscan] (Aug 23, 2022)</ref><ref>[https://etherscan.io/token/0x4e3fbd56cd56c3e72c1403e103b45db9da5b9d2b?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Convex Finance Tokens Received By Convex & Ribbon Phisher - Etherscan] (Dec 28, 2023)</ref>

== Total Amount Lost ==
Cryptonomist reports that as of June 24th, 2023, "the tally of what the hacker managed to steal is about 220 ETH<ref name="cryptonomist-88703">[https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ Convex: more info on the hack - Cryptonomist] (Jul 2, 2022)</ref>" however no further information is provided as to how that number was determined by Cryptonomist. The blockchain records of the attacker's known wallet show significantly fewer tokens being received in total<ref name=":32">[https://etherscan.io/tokentxns?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Token's Received and Sent By The Attacker's Wallet - Etherscan] (Feb 23, 2023)</ref>.

The attacker's wallet contain transactions from exploits on multiple protocols. It is unclear which specific attack these belong to and most amounts are less substantial<ref name=":33">[https://etherscan.io/tokentxns?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Token's Received and Sent By The Attacker's Wallet - Etherscan] (Feb 23, 2023)</ref>.

The total amount lost is unknown.

TBD - Sources need to be merged properly.
== Immediate Reactions ==
On June 23, 2022, the Twitter user @alexintosh reported an abnormal approval requested by the Convex Finance website, with a similar but not exact smart contract address<ref name="alexintoshtwitter-88742">[https://twitter.com/Alexintosh/status/1540047636467748870 Alexintosh - "What is this unverified contract ?" - Twitter] (Aug 23, 2022)</ref><ref name="convexcontractaddresses-88862">[https://docs.convexfinance.fi/convexfinance/faq/contract-addresses Contract Addresses - ConvexFinance] (Aug 24, 2022)</ref>.<blockquote>"What is this unverified contract? 0xF403a2c10B0B9feF8f0d4F931df5d86aD187AE31. [The] @ConvexFinance website is asking for approval for that but the correct one is 0xF403C135812408BFbE8713b5A23a04b3D48AAE31. 4 Starting/Ending Characters are the same. DNS spoofing?"</blockquote>The situation was initially reported and detailed by Twitter users @HarukoTech<ref name="harukotechdifferentcontracts-88952">[https://twitter.com/HarukoTech/status/1540088990723969027 <nowiki>HarukoTech - "[t]he attacker seems to be generating similar addresses to well know[n] protocols" - Twitter</nowiki>] (Aug 24, 2022)</ref>  and Bret Woods (@fewture)<ref name=":02">[https://twitter.com/fewture/status/1540090921034940416 <nowiki>Bret Woods (@fewture) - "[w]e're seeing hackers create addresses that match the first 4 and last 4 characters" - Twitter</nowiki>] (Feb 22, 2023)</ref>. These users provided a complex analysis of the transactions and a guide on a work around to validate transactions on hardware devices by using smaller transaction fees<ref name="harukotechdifferentcontracts-88952" /><ref name=":02" />.

TBD - Sources need to be merged properly.

It was quickly realized that multiple protocols were affected by the exploit. A Telegram group was set up for communication between the different affected protocols<ref name=":4" />.


Allbridge shared some warnings to users through Twitter<ref name=":8" /><ref name=":6" />.

https://twitter.com/Allbridge_io/status/1540100791641456643

https://twitter.com/Allbridge_io/status/1540305846164398081

https://twitter.com/Allbridge_io/status/1540020624579592192

https://twitter.com/Allbridge_io/status/1541028432234299392

It does not appear that any details about the incident were posted on their Medium page<ref name=":1" />.

== Ultimate Outcome ==
The NameCheap CEO ultimately responded on Twitter to explain that there was a hacked or compromised customer support agent and all access was removed from them<ref name="namecheapceotwitter1-8884" />. He also offered completely free Domain Vault monitoring to all affected services<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.<blockquote>"We've traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."

"In the meantime we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring."</blockquote>AllBridge posted the completion of an additional audit by Kudelski Security to their Medium on July 8th, roughly a week after the attack. While this may suggest an increased focus on security, the audit would obviously be unrelated to the website front-end or DNS services<ref name=":1" />.

== Total Amount Recovered ==
While other services affected by the DNS breach have put significant efforts together, it is unclear whether AllBridge made efforts to compensate impacted users.

The total amount recovered is unknown.

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Individual Prevention Policies ==
There are two policies which apply in this case. See the [[Prevention Policies for Individuals]] page for the full list.

=== Full Prevention ===
{{Prevention:Individual:Double Check Transactions}}

=== Limiting Losses ===
{{Prevention:Individual:Store Funds Offline}}

== Platform Prevention Policies ==
There are three different policies applying here. See the [[Prevention Policies for Platforms]] page for all policies.

=== Prevention by Namecheap ===
{{Prevention:Platform:Implement Multi-Signature}}

The issue ultimately stemmed from a single customer support agent being compromised. A multi-signature requirement on DNS changes would have prevented this scenario entirely. While NameCheap offers advanced protections on their domain names, this service had just launched two days prior to the DNS change, so it was unlikely to be a reasonable expectation that Convex Finance would have already signed up.

=== Prevention by AllBridge ===
{{Prevention:Platforms:Supply Chain Assessment}}

== Regulatory Prevention Policies ==
There is one policy to prevent the situation, and one to reduce the impact. See the [[Prevention Policies for Regulators]] page for the full list of policies.

=== Full Prevention Through Security Assessments ===
{{Prevention:Regulators:Platform Security Assessments}}

=== Reduction Through Education ===
{{Prevention:Regulators:Cryptocurrency Education Mandate}}

This could greatly reduce the effectiveness of a similar fraud to affect those such educated.

== References ==
<references>
<ref name="allbridgewebsite-10528">[https://allbridge.io/ Allbridge is the best cross-chain bridging solution provider. - Allbridge Homepage] (Feb 7, 2023)</ref>
<ref name="allbridgedocs-10529">[https://docs.allbridge.io/ What is Allbridge? - Allbridge Docs] (Feb 7, 2023)</ref>
<ref name="cloudflarewhatisdns-10527">[https://www.cloudflare.com/learning/dns/what-is-dns/ What is DNS? | How DNS works | Cloudflare] (Feb 9, 2023)</ref>
<ref name="convexpostmortem-8882">[https://convexfinance.medium.com/post-mortem-of-events-june-23-3d6db955dc7d Post Mortem Of Events June 23] (Aug 24, 2022)</ref>
<ref name="convexbacktonormaltwitter-8885">[https://twitter.com/ConvexFinance/status/1540436217438904320 @ConvexFinance Twitter] (Aug 24, 2022)</ref>
<ref name="namecheapceotwitter1-8884">[https://twitter.com/NamecheapCEO/status/1540364576151289857 <nowiki>Richard Kirkendall - "traced this down to a specific [customer support] agent that was either hacked or compromised" - Twitter</nowiki>] (Aug 24, 2022)</ref>
<ref name="namecheapceotwitter2-8889">[https://twitter.com/NamecheapCEO/status/1540384617206890496 <nowiki>@NamecheapCEO "If you want complete security use [Domain Vault]" - Twitter</nowiki>] (Aug 24, 2022)</ref>
<ref name="devancollins3replytwitter-8894">[https://twitter.com/DevanCollins3/status/1338967305297027081 @DevanCollins3 Twitter] (Aug 24, 2022)</ref>
<ref name="lefterisjptwitter-10565">[https://twitter.com/LefterisJP/status/1540306236087877635 @LefterisJP Twitter] (Feb 10, 2023)</ref>
<ref name="namecheapceotwitter3-10566">[https://twitter.com/NamecheapCEO/status/1540458990831894532 <nowiki>Richard Kirkendall - "[l]ooks more like [their customer support] person was hacked." - Twitter</nowiki>] (Feb 11, 2023)</ref>
<ref name="namecheapdomainvault1-10530">[https://web.archive.org/web/20220322072324/https://www.namecheap.com/security/domain-vault/ Domain Vault Page on Mar 22nd, 2022 - Namecheap] (Feb 9, 2023)</ref>
<ref name="namecheapdomainvault2-10567">[https://web.archive.org/web/20220619232321/https://www.namecheap.com/security/domain-vault/ Domain Vault Page on June 19th, 2022 - Namecheap] (Feb 12, 2023)</ref>
<ref name="namecheapdomainvault3-10568">[https://web.archive.org/web/20220620234159/https://www.namecheap.com/security/domain-vault/ Domain Vault Page on June 20th, 2022 - Namecheap] (Feb 12, 2023)</ref>
<ref name="namecheapdomainvault4-10569">[https://web.archive.org/web/20220624011230/https://www.namecheap.com/security/domain-vault/ Domain Vault Page on June 24th, 2022 - Namecheap] (Feb 13, 2023)</ref>
<ref name="namecheapdomainvault5-10570"> [https://web.archive.org/web/20220625021642/https://www.namecheap.com/security/domain-vault/ Domain Vault Page on June 25th, 2022 - Namecheap] (Feb 13, 2023)</ref>
<ref name="namecheapdomainvault6-10571">[https://web.archive.org/web/20220701041551/https://www.namecheap.com/security/domain-vault/ Domain Vault Page on July 1st, 2022 - Namecheap] (Feb 13, 2023)</ref>
<ref name="namecheapdomainvault7-10572">[https://web.archive.org/web/20220702050733/https://www.namecheap.com/security/domain-vault/ Domain Vault Page on July 2nd, 2022 - Namecheap] (Feb 13, 2023)</ref>
</references>