AirDropsDAC HireVibes Airdrop Private Key Leak - Revision history

Azoundria at 18:55, 1 May 2023

2023-05-01T18:55:31Z

← Older revision		Revision as of 12:55, 1 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/airdropsdachirevibesairdropprivatekeyleak.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/airdropsdachirevibesairdropprivatekeyleak.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Airdropsdac.jpg\|thumb\|AirDropsDAC]]The HireVibes protocol ran an airdrop through the AirDropsDAC project. The private keys of the smart contract were apparently breached, and the tokens were taken and liquidated. The airdrop was run without AirDropsDAC being involved, and a bonus was given for all participants.		[[File:Airdropsdac.jpg\|thumb\|AirDropsDAC]]The HireVibes protocol ran an airdrop through the AirDropsDAC project. The private keys of the smart contract were apparently breached, and the tokens were taken and liquidated. The airdrop was run without AirDropsDAC being involved, and a bonus was given for all participants.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="slowmisthacked-5002" /><ref name="airdropsdacarchive-5011" /><ref name="hirevibes-5012" /><ref name="everipedia-5013" /><ref name="coingecko-5014" /><ref name="hirevibesmedium-5015" /><ref name="hirevibesmedium-5016" /><ref name="hirevibesmedium-5017" />
	<ref name="slowmisthacked-5002" /><ref name="airdropsdacarchive-5011" /><ref name="hirevibes-5012" /><ref name="everipedia-5013" /><ref name="coingecko-5014" /><ref name="hirevibesmedium-5015" /><ref name="hirevibesmedium-5016" /><ref name="hirevibesmedium-5017" />

	== About AirDropsDAC ==		== About AirDropsDAC ==
Line 65:		Line 64:
	!Description		!Description
	\|-		\|-
	\|November 12th, 2018 ~~12:00:00 AM~~		\|November 12th, 2018
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 73:		Line 72:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 92:		Line 94:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Private keys need to be stored offline. One of the easiest ways to protect against this would have been to set up a multi-signature requirement on the primary wallet. Additional training for operators is also useful.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	Private keys need to be stored offline. One of the easiest ways to protect against this would have been to set up a multi-signature requirement on the primary wallet. Additional training for operators is also useful.

	== References ==		== References ==
	<references><ref name="slowmisthacked-5002">[https://hacked.slowmist.io/en/?c=EOS&page=5 SlowMist Hacked - SlowMist Zone] (Dec 19, 2021)</ref>		<references><ref name="slowmisthacked-5002">[https://hacked.slowmist.io/en/?c=EOS&page=5 SlowMist Hacked - SlowMist Zone] (Dec 20, 2021)</ref>

	<ref name="airdropsdacarchive-5011">[https://web.archive.org/web/20190404045845/https://airdropsdac.com/ AirdropsDAC – Airdropping Since June 2018] (Dec 29, 2021)</ref>		<ref name="airdropsdacarchive-5011">[https://web.archive.org/web/20190404045845/https://airdropsdac.com/ AirdropsDAC – Airdropping Since June 2018] (Dec 30, 2021)</ref>

	<ref name="hirevibes-5012">[https://www.hirevibes.io/ HireVibes - Attract Your Tribe] (Dec 29, 2021)</ref>		<ref name="hirevibes-5012">[https://www.hirevibes.io/ HireVibes - Attract Your Tribe] (Dec 30, 2021)</ref>

	<ref name="everipedia-5013">[https://everipedia.org/wiki/lang_en/hirevibes https://everipedia.org/wiki/lang_en/hirevibes] (Dec 29, 2021)</ref>		<ref name="everipedia-5013">[https://everipedia.org/wiki/lang_en/hirevibes https://everipedia.org/wiki/lang_en/hirevibes] (Dec 30, 2021)</ref>

	<ref name="coingecko-5014">[https://www.coingecko.com/en/coins/hirevibes/eos https://www.coingecko.com/en/coins/hirevibes/eos] (Dec 29, 2021)</ref>		<ref name="coingecko-5014">[https://www.coingecko.com/en/coins/hirevibes/eos https://www.coingecko.com/en/coins/hirevibes/eos] (Dec 30, 2021)</ref>

	<ref name="hirevibesmedium-5015">[https://hirevibes.medium.com/hirevibes-statement-regarding-recent-exploit-1c72d6279512 Hirevibes Statement Regarding Recent Exploit] (Dec 29, 2021)</ref>		<ref name="hirevibesmedium-5015">[https://hirevibes.medium.com/hirevibes-statement-regarding-recent-exploit-1c72d6279512 Hirevibes Statement Regarding Recent Exploit] (Dec 30, 2021)</ref>

	<ref name="hirevibesmedium-5016">[https://hirevibes.medium.com/airdrop-update-hvt-for-everyone-de2e7e61c777 Airdrop Update Hvt For Everyone] (Dec 29, 2021)</ref>		<ref name="hirevibesmedium-5016">[https://hirevibes.medium.com/airdrop-update-hvt-for-everyone-de2e7e61c777 Airdrop Update Hvt For Everyone] (Dec 30, 2021)</ref>

	<ref name="hirevibesmedium-5017">[https://hirevibes.medium.com/hirevibes-airdrop-and-user-prototype-release-edb460dfd809 Hirevibes Airdrop And User Prototype Release] (Dec 29, 2021)</ref></references>		<ref name="hirevibesmedium-5017">[https://hirevibes.medium.com/hirevibes-airdrop-and-user-prototype-release-edb460dfd809 Hirevibes Airdrop And User Prototype Release] (Dec 30, 2021)</ref></references>

Azoundria at 07:49, 17 February 2023

2023-02-17T07:49:12Z

← Older revision		Revision as of 01:49, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/airdropsdachirevibesairdropprivatekeyleak.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/airdropsdachirevibesairdropprivatekeyleak.php}}
			{{Unattributed Citations}}

	[[File:Airdropsdac.jpg\|thumb\|AirDropsDAC]]The HireVibes protocol ran an airdrop through the AirDropsDAC project. The private keys of the smart contract were apparently breached, and the tokens were taken and liquidated. The airdrop was run without AirDropsDAC being involved, and a bonus was given for all participants.		[[File:Airdropsdac.jpg\|thumb\|AirDropsDAC]]The HireVibes protocol ran an airdrop through the AirDropsDAC project. The private keys of the smart contract were apparently breached, and the tokens were taken and liquidated. The airdrop was run without AirDropsDAC being involved, and a bonus was given for all participants.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="slowmisthacked-5002" /><ref name="airdropsdacarchive-5011" /><ref name="hirevibes-5012" /><ref name="everipedia-5013" /><ref name="coingecko-5014" /><ref name="hirevibesmedium-5015" /><ref name="hirevibesmedium-5016" /><ref name="hirevibesmedium-5017" />

	== About AirDropsDAC ==		== About AirDropsDAC ==
Line 43:		Line 45:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 65:		Line 66:
	\|-		\|-
	\|November 12th, 2018 12:00:00 AM		\|November 12th, 2018 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 78:		Line 75:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $14,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 89:		Line 86:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 100:		Line 97:

	== References ==		== References ==
	[https://hacked.slowmist.io/en/?c=EOS&page=5 SlowMist Hacked - SlowMist Zone] (Dec 19)		<references><ref name="slowmisthacked-5002">[https://hacked.slowmist.io/en/?c=EOS&page=5 SlowMist Hacked - SlowMist Zone] (Dec 19, 2021)</ref>

	[https://web.archive.org/web/20190404045845/https://airdropsdac.com/ AirdropsDAC – Airdropping Since June 2018] (Dec 29)		<ref name="airdropsdacarchive-5011">[https://web.archive.org/web/20190404045845/https://airdropsdac.com/ AirdropsDAC – Airdropping Since June 2018] (Dec 29, 2021)</ref>

	[https://www.hirevibes.io/ HireVibes - Attract Your Tribe] (Dec 29)		<ref name="hirevibes-5012">[https://www.hirevibes.io/ HireVibes - Attract Your Tribe] (Dec 29, 2021)</ref>

	[https://everipedia.org/wiki/lang_en/hirevibes https://everipedia.org/wiki/lang_en/hirevibes] (Dec 29)		<ref name="everipedia-5013">[https://everipedia.org/wiki/lang_en/hirevibes https://everipedia.org/wiki/lang_en/hirevibes] (Dec 29, 2021)</ref>

	[https://www.coingecko.com/en/coins/hirevibes/eos https://www.coingecko.com/en/coins/hirevibes/eos] (Dec 29)		<ref name="coingecko-5014">[https://www.coingecko.com/en/coins/hirevibes/eos https://www.coingecko.com/en/coins/hirevibes/eos] (Dec 29, 2021)</ref>

	[https://hirevibes.medium.com/hirevibes-statement-regarding-recent-exploit-1c72d6279512 Hirevibes Statement Regarding Recent Exploit] (Dec 29)		<ref name="hirevibesmedium-5015">[https://hirevibes.medium.com/hirevibes-statement-regarding-recent-exploit-1c72d6279512 Hirevibes Statement Regarding Recent Exploit] (Dec 29, 2021)</ref>

	[https://hirevibes.medium.com/airdrop-update-hvt-for-everyone-de2e7e61c777 Airdrop Update Hvt For Everyone] (Dec 29)		<ref name="hirevibesmedium-5016">[https://hirevibes.medium.com/airdrop-update-hvt-for-everyone-de2e7e61c777 Airdrop Update Hvt For Everyone] (Dec 29, 2021)</ref>

	[https://hirevibes.medium.com/hirevibes-airdrop-and-user-prototype-release-edb460dfd809 Hirevibes Airdrop And User Prototype Release] (Dec 29)		<ref name="hirevibesmedium-5017">[https://hirevibes.medium.com/hirevibes-airdrop-and-user-prototype-release-edb460dfd809 Hirevibes Airdrop And User Prototype Release] (Dec 29, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/airdropsdachirevibesairdropprivatekeyleak.php}} AirDropsDACThe HireVibes protocol ran an airdrop through the AirDropsDAC project. The private keys of the smart contract were apparently breached, and the tokens were taken and liquidated. The airdrop was run without AirDropsDAC being involved, and a bonus was given for all participants. This is a global/international..."

2023-01-24T21:35:49Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/airdropsdachirevibesairdropprivatekeyleak.php}} thumb|AirDropsDACThe HireVibes protocol ran an airdrop through the AirDropsDAC project. The private keys of the smart contract were apparently breached, and the tokens were taken and liquidated. The airdrop was run without AirDropsDAC being involved, and a bonus was given for all participants. This is a global/international..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/airdropsdachirevibesairdropprivatekeyleak.php}}

[[File:Airdropsdac.jpg|thumb|AirDropsDAC]]The HireVibes protocol ran an airdrop through the AirDropsDAC project. The private keys of the smart contract were apparently breached, and the tokens were taken and liquidated. The airdrop was run without AirDropsDAC being involved, and a bonus was given for all participants.

This is a global/international case not involving a specific country.

== About AirDropsDAC ==
"AirdropsDAC provides Airdrops As A Service to dapp developers in the EOS ecosystem looking to tokenize their project. AirdropsDAC looks to be the foremost authority in airdrops, offering the most options for innovative airdrops, legal-friendly tokens, community engagement tools and marketing to ensure the project’s users are ready and engaged to adopt the dapp."

"HireVibes (ticker symbol: HVT) is a decentralized jobs platform that incentivizes people to crowd-source candidates for jobs positions. It was built and operates as a decentrilized application on top of EOS blockchain. It is the flagship project of EOSVibes." "HireVibes aims to disrupt traditional Human Resources (HR) and recruiting."

"The demand for Web3 talent is rising faster than supply. Bitcoin and blockchain technology are helping us create a better world. We're creating an open source standard for hiring in the Web3 era."

"Showcase your employer brand by using a cryptocurrency powered hiring platform to build world changing teams. Whether you're a growing technology company or a fledgling DAO; HireVibes has you covered."

"A large number of HVTs in the AirDropsDAC contract account were transferred to the sym111111add account under abnormal operation. The account was then exchanged for 2,514 EOS at Newdex, which was subsequently transferred to the gizdkmjvhege account."

"In light of the recent exploit which took place on November 12th 2018, the HireVibes development team would like to reassure our community that HireVibes keys and token smart contract and were never compromised. They are secure and under the supervision of the HireVibes team."

"This incident involved a third party that was providing an airdrop service to HireVibes at the time of the exploit. The HireVibes development team treats security as the utmost priority. A member of the HireVibes team alerted our service provider of the exploit, which is currently being investigated."

"HireVibes are taking a neutral position while the facts are established. Meanwhile, development is continuing as normal as we work towards the release of HireVibes Beta early in 2019."

"As a bonus to all accounts that did claim HVT by Monday December 3rd at 1300 UTC, as well as accounts which were missed on the airdrop, HireVibes will give an extra % of HVT to those accounts. The exact bonus % will be announced, and the delivery of tokens will happen by Wednesday December 5th."

"We are doing this because we listened to the needs our community and it also means HVT will be a more widely distributed token, which is essential for a vibrant token economy."

"While we are appreciative to AirdropsDAC to get a chance to trial a new innovative airdrop method (claim invitations), the HireVibes team will complete the airdrop, and distribute tokens to everyone on the snapshot."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - AirDropsDAC HireVibes Airdrop Private Key Leak
!Date
!Event
!Description
|-
|November 12th, 2018 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Private keys need to be stored offline. One of the easiest ways to protect against this would have been to set up a multi-signature requirement on the primary wallet. Additional training for operators is also useful.

== References ==
[https://hacked.slowmist.io/en/?c=EOS&page=5 SlowMist Hacked - SlowMist Zone] (Dec 19)

[https://web.archive.org/web/20190404045845/https://airdropsdac.com/ AirdropsDAC – Airdropping Since June 2018] (Dec 29)

[https://www.hirevibes.io/ HireVibes - Attract Your Tribe] (Dec 29)

[https://everipedia.org/wiki/lang_en/hirevibes https://everipedia.org/wiki/lang_en/hirevibes] (Dec 29)

[https://www.coingecko.com/en/coins/hirevibes/eos https://www.coingecko.com/en/coins/hirevibes/eos] (Dec 29)

[https://hirevibes.medium.com/hirevibes-statement-regarding-recent-exploit-1c72d6279512 Hirevibes Statement Regarding Recent Exploit] (Dec 29)

[https://hirevibes.medium.com/airdrop-update-hvt-for-everyone-de2e7e61c777 Airdrop Update Hvt For Everyone] (Dec 29)

[https://hirevibes.medium.com/hirevibes-airdrop-and-user-prototype-release-edb460dfd809 Hirevibes Airdrop And User Prototype Release] (Dec 29)