BadgerDAO Malicious Code Injected - Revision history

Azoundria at 22:00, 10 May 2024

2024-05-10T22:00:44Z

← Older revision		Revision as of 16:00, 10 May 2024
Line 3:		Line 3:
	[[File:Badgerdao.jpg\|thumb\|BadgerDAO Homepage]]BadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has been improved and 40% of funds have been recovered. There are suggestions of other measures to recover the rest.		[[File:Badgerdao.jpg\|thumb\|BadgerDAO Homepage]]BadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has been improved and 40% of funds have been recovered. There are suggestions of other measures to recover the rest.

	This is a global/international case not involving a specific country.<ref name="thewebserv-4692" /><ref name="invezz-5020" /><ref name="cryptopotato-5021" /><ref name="badger-5022" /><ref name="badgerdaotwitter-5023" /><ref name="badger-5024" /><ref name="badger-5025" /><ref name="badgerapparchive-5026" /><ref name="etherscan-5027" /><ref name="badger-5028" /><ref name="badger-5029" /><ref name="badgerdocs-5030" /><ref name="googledoc-5031" /><ref name="badger-5032" /><ref name="theverge-5033" /><ref name="peckshieldtwitter-5034" /><ref name="coindesk-5035" /><ref name="zengo-5036" /><ref name="rektnews-7842" /><ref name="talbeerysectwitter-8681" /><ref name="cryptonews-9847" /><ref name="cryptonews-9850" />		This is a global/international case not involving a specific country.<ref name="thewebserv-4692" /><ref name="invezz-5020" /><ref name="cryptopotato-5021" /><ref name="badger-5022" /><ref name="badgerdaotwitter-5023" /><ref name="badger-5024" /><ref name="badger-5025" /><ref name="badgerapparchive-5026" /><ref name="etherscan-5027" /><ref name="badger-5028" /><ref name="badger-5029" /><ref name="badgerdocs-5030" /><ref name="googledoc-5031" /><ref name="badger-5032" /><ref name="theverge-5033" /><ref name="peckshieldtwitter-5034" /><ref name="coindesk-5035" /><ref name="zengo-5036" /><ref name="rektnews-7842" /><ref name="talbeerysectwitter-8681" /><ref name="cryptonews-9847" /><ref name="cryptonews-9850" /><ref name="carnegieendowment-9983" />

	== About BadgerDAO ==		== About BadgerDAO ==
Line 175:		Line 175:
	<ref name="cryptonews-9847">[https://cryptonews.com/news/badger-dao-appears-to-have-lost-over-usd-62m-in-an-attack.htm Badger DAO Appears to Have Lost Over USD 120M in an Attack] (Dec 1, 2022)</ref>		<ref name="cryptonews-9847">[https://cryptonews.com/news/badger-dao-appears-to-have-lost-over-usd-62m-in-an-attack.htm Badger DAO Appears to Have Lost Over USD 120M in an Attack] (Dec 1, 2022)</ref>
	<ref name="cryptonews-9850">[https://cryptonews.com/news/santa-hackathon-visor-finance-marks-7th-hack-december.htm Santa Hackathon? Visor Finance Marks 7th Hack in December] (Dec 1, 2022)</ref>		<ref name="cryptonews-9850">[https://cryptonews.com/news/santa-hackathon-visor-finance-marks-7th-hack-december.htm Santa Hackathon? Visor Finance Marks 7th Hack in December] (Dec 1, 2022)</ref>
			<ref name="carnegieendowment-9983">[https://carnegieendowment.org/specialprojects/protectingfinancialstability/timeline Timeline of Cyber Incidents Involving Financial Institutions - Carnegie Endowment for International Peace] (Dec 12, 2022)</ref>
	</references>		</references>

Azoundria: Another 30 minutes complete. Additional sources merged in. Prevention completed. Information moved around.

2023-09-28T22:21:36Z

Another 30 minutes complete. Additional sources merged in. Prevention completed. Information moved around.

← Older revision		Revision as of 16:21, 28 September 2023
Line 25:		Line 25:
	!Description		!Description
	\|-		\|-
	\|~~December 2nd~~, 2021		\|November 20th, 2021 3:06:25 AM MST
	\|~~Main Event~~		\|Initial Funding Of Exploit Wallet
	\|~~Expand this into a brief description~~ of ~~what happened and~~ the ~~impact~~. ~~If multiple lines~~ are ~~necessary~~, ~~add them here~~.		\|The exploiter wallet is first funded on the blockchain<ref>[https://etherscan.io/tx/0x5bad936ed37aa5c8ee8a7c7ae69b28b822be05c334d4f2aa3b9059151e7800b6 Transfer of 0.041149441378804059 ETH to the Exploiter's Wallet - Etherscan] (Sep 28, 2023)</ref>.
			\|-
			\|December 1st, 2021 5:48:25 PM MST
			\|Blockchain Transfers Start
			\|204.539433413030539153 BiBTC are transferred from an exploited address to the attacker<ref name=":0">[https://etherscan.io/tx/0xcc0903051732b6e92b439fff681e09d04a91b747ef7230d191cad02c0df9bf6e Transfer of 204.539433413030539153 BiBTC to the attacker - Etherscan] (Sep 28, 2023)</ref>.
	\|-		\|-
	\|December 2nd, 2021 1:14:00 PM MST		\|December 2nd, 2021 1:14:00 PM MST
	\|Tal Be'ery Technical Analysis		\|Tal Be'ery Technical Analysis
	\|<ref name="talbeerysectwitter-8681" />.		\|Researcher Tal Be'ery publishes a detailed analysis of the BadgerDAO exploit on Twitter<ref name="talbeerysectwitter-8681" />.
	\|}		\|}

	== Technical Details ==		== Technical Details ==
	The vulnerability was related to the Cloudflare API for the BadgerDAO website and a sophisticated attacker who was injecting malicious scripts. Select users of the site with large balances would be routinely tricked into authorizing access to other wallets, while users with smaller balances or developers of the protocol wouldn't see any malicious code.		The vulnerability was related to the Cloudflare API for the BadgerDAO website and a sophisticated attacker who was injecting malicious scripts. Select users of the site with large balances would be routinely tricked into authorizing access to other wallets, while users with smaller balances or developers of the protocol wouldn't see any malicious code.<ref name=":0" /><ref>[https://etherscan.io/tx/0x2b3a0e24b59daef540f5ff579422bd8f66f748b2b85613e2592ff56ce82010f2 Transfer of 172.445055240571417888 BiBTC to the Attacker - Etherscan] (Sep 28, 2023)</ref><ref>[https://etherscan.io/tx/0x5973ea352314dd079517e05c258ce8989e04d8d7859afa06de66ce5f05e0ff4e Transfer of 111.029961377265239943 BiBTC to the attacker - Etherscan] (Sep 28, 2023)</ref>

	=== Unauthorized Cloudflare API Access ===		=== Unauthorized Cloudflare API Access ===
Line 48:		Line 52:

	=== Technical Analysis By Tal Be'ery ===		=== Technical Analysis By Tal Be'ery ===
	<ref name="talbeerysectwitter-8681" />		Tal Be'ery provided a walkthrough of the exploit<ref name="talbeerysectwitter-8681" />.<blockquote>1/ #BadgerDAO hack : Attackers were able to compromise Badger website and inject a malicious javascript to request from Badger users ERC20 approvals for the attackers address.

			2/ If the users approved this request via their wallet (e.g. metamask), they had effectively allowed attackers to spend the victims' funds. Here's one from 28.11 (4 days ago)

			3/ Yesterday, (1.12) the attackers caught the big fish. A user with $50M approved their malicious request

			4/ The attackers decided it's time to monetize and this user was the first one to be exploited (followed by the other victims)

			</blockquote>

	== Total Amount Lost ==		== Total Amount Lost ==
Line 111:		Line 123:
	{{Prevention:Individuals:Store Funds Offline}}		{{Prevention:Individuals:Store Funds Offline}}

	Individuals may further avoid risk by preferring services with higher security validations.		Individuals may further avoid risk by preferring services with higher security emphasis and additional validations.

	{{Prevention:Individuals:Safe Smart Contract Usage}}		{{Prevention:Individuals:Safe Smart Contract Usage}}
Line 118:		Line 130:

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	The Cloudflare vulnerability was missed when Badger was reviewed. All validation focused on the smart contract, and there was limited detailed analysis of their website infrastructure.		The Cloudflare vulnerability was missed when Badger was reviewed. All validation focused on the smart contract, and there was limited detailed analysis of their website infrastructure. A more comprehensive analysis would have been much more likely to catch the issue.

	{{Prevention:Platforms:Regular Audit Procedures}}		{{Prevention:Platforms:Regular Audit Procedures}}
Line 129:		Line 141:

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	The Cloudflare vulnerability was missed when Badger was reviewed. All validation focused on the smart contract, and there was limited detailed analysis of their website infrastructure.		The Cloudflare vulnerability was missed when Badger was reviewed. All validation focused on the smart contract, and there was limited detailed analysis of their website infrastructure. A more comprehensive analysis would have been much more likely to catch the issue.

	{{Prevention:Regulators:Platform Security Assessments}}		{{Prevention:Regulators:Platform Security Assessments}}

Azoundria: Another 30 minutes complete. Additional sources merged in. Working on prevention. Information moved around.

2023-09-14T00:33:14Z

Another 30 minutes complete. Additional sources merged in. Working on prevention. Information moved around.

Show changes

Azoundria at 21:33, 7 May 2023

2023-05-07T21:33:42Z

← Older revision		Revision as of 15:33, 7 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/badgerdaomaliciouscodeinjected.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/badgerdaomaliciouscodeinjected.php}}
	{{Unattributed Sources}}		{{Unattributed Sources}}

	[[File:Badgerdao.jpg\|thumb\|BadgerDAO]]BadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has een improved and 40% of funds have been recovered. There are suggestions of other measures to recover the rest.		[[File:Badgerdao.jpg\|thumb\|BadgerDAO]]BadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has een improved and 40% of funds have been recovered. There are suggestions of other measures to recover the rest.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="thewebserv-4692" /><ref name="invezz-5020" /><ref name="cryptopotato-5021" /><ref name="badger-5022" /><ref name="badgerdaotwitter-5023" /><ref name="badger-5024" /><ref name="badger-5025" /><ref name="badgerapparchive-5026" /><ref name="etherscan-5027" /><ref name="badger-5028" /><ref name="badger-5029" /><ref name="badgerdocs-5030" /><ref name="googledoc-5031" /><ref name="badger-5032" /><ref name="theverge-5033" /><ref name="peckshieldtwitter-5034" /><ref name="coindesk-5035" /><ref name="zengo-5036" /><ref name="rektnews-7842" /><ref name="talbeerysectwitter-8681" /><ref name="cryptonews-9847" /><ref name="cryptonews-9850" />
	<ref name="thewebserv-4692" /><ref name="invezz-5020" /><ref name="cryptopotato-5021" /><ref name="badger-5022" /><ref name="badgerdaotwitter-5023" /><ref name="badger-5024" /><ref name="badger-5025" /><ref name="badgerapparchive-5026" /><ref name="etherscan-5027" /><ref name="badger-5028" /><ref name="badger-5029" /><ref name="badgerdocs-5030" /><ref name="googledoc-5031" /><ref name="badger-5032" /><ref name="theverge-5033" /><ref name="peckshieldtwitter-5034" /><ref name="coindesk-5035" /><ref name="zengo-5036" /><ref name="rektnews-7842" /><ref name="talbeerysectwitter-8681" /><ref name="cryptonews-9847" /><ref name="cryptonews-9850" />

	== About BadgerDAO ==		== About BadgerDAO ==
Line 101:		Line 100:
	!Description		!Description
	\|-		\|-
	\|December 2nd, 2021 ~~12:00:00 AM~~		\|December 2nd, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 109:		Line 108:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 128:		Line 130:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			There are a number of ways to prevent and mitigate this situation. It is far more secure to have the majority of funds in a multi-signature wallet where keys are stored offline by multiple operators. This would limit the potential loss to only those funds being actively within the hot wallet. Audits can be used to reduce the risks on the hot wallets further, and we advocate at least 2 reviews would be required prior to a project launch. We also propose a comprehensive industry insurance fund which could be available to assist.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	There are a number of ways to prevent and mitigate this situation. It is far more secure to have the majority of funds in a multi-signature wallet where keys are stored offline by multiple operators. This would limit the potential loss to only those funds being actively within the hot wallet. Audits can be used to reduce the risks on the hot wallets further, and we advocate at least 2 reviews would be required prior to a project launch. We also propose a comprehensive industry insurance fund which could be available to assist.

	== References ==		== References ==

Azoundria at 17:47, 28 February 2023

2023-02-28T17:47:30Z

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/badgerdaomaliciouscodeinjected.php}} BadgerDAOBadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has een improved and 40%..."

2023-01-28T04:06:00Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/badgerdaomaliciouscodeinjected.php}} thumb|BadgerDAOBadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has een improved and 40%..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/badgerdaomaliciouscodeinjected.php}}

[[File:Badgerdao.jpg|thumb|BadgerDAO]]BadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has een improved and 40% of funds have been recovered. There are suggestions of other measures to recover the rest.

This is a global/international case not involving a specific country.

== About BadgerDAO ==
"Earn Interest on Your Bitcoin. BadgerDAO makes it easy to bring your Bitcoin to DeFi and start earning yield today." "BadgerDAO is building the infrastructure to bring Bitcoin to DeFi. We make it easy to bridge your Bitcoin into other blockchains and start earning yield right away."

"BadgerDAO is a decentralized autonomous organization (DAO) run by our users – not VCs, whales, or institutions." "DeFi innovation has paved the way for a number of protocols, including Badger, to offer significant returns. Badger has one of the most security minded teams in DeFi and has pioneered several practices to minimize risk."

"Badger Sett is a yield aggregator product that leverages automated strategies to generate yield for user deposits of various underlying assets. They are non-custodial, transparent, and users can withdraw their assets at any time. The bulk of existing Setts are based on the Yearn Vaults V1 architecture, expanding it with new strategies, a new fee structure, and modifications to the governance of the system."

"BadgerDAO’s smart contracts are regularly audited by top security firms to discover and fix vulnerabilities before launch. Audit reports are linked below. Please note that audit reports cover specific portions of the BadgerDAO codebase and are done at a snapshot in time. Our code is frequently updated, which could introduce new vulnerabilities."

"In late September, users on a Cloudflare community support forum reported that unauthorized users were able to create accounts and were also able to create and view (Global) API keys (which cannot be deleted or deactivated) before email verification was completed (see Cloudflare Forum Post). It was noted that an attacker could then wait for the email to be verified, and for the account creation to be completed, and they would then have API access."

"In mid-September, Badger unknowingly completed the account creation for one of these three compromised accounts, which were used for legitimate Cloudflare management activities. The UI did not make it obvious that the account had already been created and an API key was accordingly generated."

"On November 10, the attacker began using their API access to inject malicious scripts via Cloudflare Workers into the html of app.badger.com. The script intercepted web3 transactions and prompted users to allow a foreign address approval to operate on ERC-20 tokens in their wallet. On November 20, the first on-chain malicious approval was made for the exploiter wallet."

"The attacker used several anti-detection techniques in their attack. They applied and removed the script periodically over the month of November, often for very short periods of time. The attacker also only targeted wallets over a certain balance, and explicitly avoided targeting listed signers of the Dev Multisig. Finally, the attacker accessed the API from multiple proxy and VPN IP addresses and changed the script on each deployment so they each had a unique hash, rendering static indicators of limited value."

"[L]ast week, Celsius Network CEO Alex Masinsky said the crypto lending platform lost $120 million due to the hacking of its decentralized financial platform Badger DAO."

"On Dec 2 2021, a series of unauthorized transactions occurred, resulting in the loss of funds from Badger users. Following the exploit, Badger engineers worked with cybersecurity firm Mandiant to investigate the incident and have prepared the following initial report." "The Badger community raised an alert via Discord about a large, suspicious transaction on December 2." "The attack was noticed by a Community member when approximately 900 BTC were removed from the Yearn wBTC vault."

"This news comes after bad actors hacked BadgerDAO, a decentralized autonomous organization that lets users stake BTC as collateral across DeFi applications. The attack saw the DAO lose $120 million (£90.41). The hack allegedly saw Celsius Network lose over $50 million (£37.67 million) worth of wrapped Bitcoin (wBTC)."

"Here’s the breakdown of affected assets. 2017 BTC (~$113m) 53 DIGG (~3.2m) 26.56 ETH (~0.1m) 730 CVX (~0.018m) The affected assets will be accounted for in BTC and USD at the time of the exploit. BTC is disproportionately the largest asset lost and USD is a recognized global unit of account." "When all affected assets are converted to BTC at the time of the hack this is approximately 2076.54 BTC (~$116.3m USD at time of hack) 2019.37 BTC if DIGG is excluded for consideration by the community for special compensation."

"Badger immediately paused most vault activity within 30 minutes of the alert. A handful of older contracts with a single, inaccessible guardian were paused approximately 15 hours later."

"In partnership with cybersecurity firm Mandiant, Badger prepared a technical document outlining the understanding of how the front end attack happened."

"Badger believes that, as publicly reported, the phishing incident that occurred on 2 Dec, 2021 was the result of a maliciously injected snippet provided by Cloudflare Workers. Cloudflare Workers is an interface to run scripts that operate on and alter web traffic as it flows through Cloudflare proxies. The attacker deployed the worker script via a compromised API key that was created without the knowledge or authorization of Badger engineers. The attacker(s) used this API access to periodically inject malicious code into the Badger application such that it only affected a subset of the user base."

"Per the responses on the Cloudflare forum, the vulnerability appears to have been mitigated around September 29." "Badger is continuing to work with Cloudflare to collect more relevant data, fully scope this incident and assist in their own post-mortem."

"Per BIP-33, addresses approved on the guardian contract have the ability to pause contracts. The pausing functionality of these contracts operates in a manner that blocks any deposit, withdrawal, transfer for ERC20 vaults, withdrawals from strategies, and any minting/redeeming of ibBTC until the unpause function is called on them. Unpausing is restricted to the Dev Multisig, which requires governance approval. Eight older strategies and one vault also require a timelock to unpause."

"Most contracts were paused by 3:30 AM UTC. Some older vaults, (namely bcrvRenBTC, bcrvSBTC, bcrvTBTC, bBADGER, bharvestcrvRenBTC and buniWbtcBadger) do not have pause functionality on the vault contract. Their strategies were nevertheless paused to prevent withdrawals. At the time Badger engineers were unable to access the guardian account of the bBADGER, bharvestcrvRenBTC and buniWbtcBadger strategies. Further investigation revealed the strategist who helped come up with this smart contract idea also had pausing capabilities, and pausers were eventually able to pause the strategies with the strategist account."

"[T]he last malicious withdrawal from the unpaused vaults occurred at 4:57 AM UTC. All withdrawals that took place after this and until the pausing of the last strategy were conducted by regular users." "It is also worth mentioning that the attacker was able to compromise non-Sett tokens, such as BADGER, wBTC, CVX and cvxCRV, and was able to liquidate them after Badger had enacted the pauses."

"The Badger Cloudflare account has had the password updated, MFA changed and all API keys either deleted or refreshed where possible."

"Badger is working with Chainalaysis, Mandiant, and the crypto exchanges as well as authorities in the US and Canada to recover any funds possible."

"Following the attack, Badger engineers, together with world class blockchain and Web2 cybersecurity experts Mandiant, conducted a full review of our security practices, looking at everything from the smart contract layer, to the app infrastructure, to how we communicate with and educate users."

"While Badger's smart contracts were not involved in the attack, we are continuing to follow Solidity development best practices, including: Partnering with some of the leading auditing firms to audit code for new functionality and features. A growing working group of security-minded Solidity developers who review new contracts. Each new strategy and vault is peer reviewed by two developers, before being approved by a senior developer. For incremental improvements collaborating on peer-reviews by trusted white hats, emerging contract security-focused DAOs, and public security auditing contests and bounties. Badger’s $750k bug bounty with Immunefi on smart contracts has yet to be claimed, and provides a strong incentive for white hat reporting of vulnerabilities."

"Badger is currently working with cybersecurity firm Halborn to conduct a thorough security audit of our new infrastructure."

"After extensive internal security reviews, upgrades, and the implementation of new safeguards with the support of Mandiant, Badger smart contracts have been safely reactivated."

"The BadgerDAO treasury’s non-native assets currently earmarked to be used for long-term operational runway can be used to commit to compensation efforts. This money could be immediately paid to victims either directly or indirectly."

"The non-circulating BADGER currently held by BadgerDAO could be scheduled to be emitted over a fixed timeframe to victims. This program should be evaluated at the end of that chosen timeframe."

"BadgerDAO could create and distribute an accounting token to victims. This would allow BadgerDAO’s team to pursue novel yield farming programs and redirect future yields to victims over a fixed timeframe. This program should be evaluated at the end of that chosen timeframe."

"[S]ome funds were transferred by the exploiter but not yet withdrawn from the Badger vaults." "As per BIP 78, all Recoverable Assets have been returned to the wallets from which they were taken. This represents close to 40% of all affected users." "Harvests will resume shortly and will include awards accrued since pausing. Users who withdraw from a vault position prior to the next harvest cycle will forfeit the accrued rewards from that position."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - BadgerDAO Malicious Code Injected
!Date
!Event
!Description
|-
|December 2nd, 2021 12:00:00 AM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $116,300,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
There are a number of ways to prevent and mitigate this situation. It is far more secure to have the majority of funds in a multi-signature wallet where keys are stored offline by multiple operators. This would limit the potential loss to only those funds being actively within the hot wallet. Audits can be used to reduce the risks on the hot wallets further, and we advocate at least 2 reviews would be required prior to a project launch. We also propose a comprehensive industry insurance fund which could be available to assist.

== References ==
[https://thewebserv.com/business/bitmart-suspends-withdrawals-after-hackers-drained-almost-200-million-in-cryptocurrencies-using-a-stolen-private-key/ BitMart suspends withdrawals after hackers drained almost $200 million in cryptocurrencies using a stolen private key] (Dec 22)

[https://invezz.com/news/2021/12/06/bitmart-ceo-claims-stolen-private-keys-led-to-the-196m-hack/ BitMart CEO claims stolen private keys led to the $196M hack | Invezz] (Dec 22)

[https://cryptopotato.com/celsius-network-reportedly-lost-50-million-in-the-120-million-badgerdao-hack/ Celsius Network Reportedly Lost $50 Million in the $120 Million BadgerDAO Hack] (Dec 30)

[https://badger.com/ Building Defi for Bitcoin - Badger] (Dec 30)

[https://twitter.com/BadgerDAO/status/1472026124523872260 @BadgerDAO Twitter] (Dec 30)

[https://badger.com/news/turning-lights-on Turning the Lights Back On] (Dec 30)

[https://badger.com/technical-post-mortem BadgerDAO Exploit Technical Post Mortem] (Dec 30)

[https://web.archive.org/web/20211129101319/https://app.badger.com/ Badger DAO | Deposit & Earn on your Bitcoin] (Dec 30)

[https://etherscan.io/tx/0x951babdddbfbbba81bbbb7991a959d9815e80cc5d9418d10e692f41541029869 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 30)

[https://badger.com/news/badger-security-upgrades Badger Security Upgrades] (Dec 30)

[https://badger.com/recovery-phase Recovery Phase] (Dec 30)

[https://docs.badger.com/badger-finance/ Setts Overview & Fees - Badger Finance] (Dec 30)

[https://docs.google.com/document/d/1nCrYyw4X4bX0XqZRzP3Tj5IF-goYoNSrOtMAWHIXjow/edit BadgerDAO Treasury Overview - Google Docs] (Dec 30)

[https://badger.com/security-and-audits Security & Audits] (Dec 30)

[https://www.theverge.com/2021/12/2/22814849/badgerdao-defi-120-million-hack-bitcoin-ethereum BadgerDAO hackers stole $120 million in crypto with a simple but effective attack - The Verge] (Dec 30)

[https://twitter.com/peckshield/status/1466294179676372992 @peckshield Twitter] (Dec 30)

[https://www.coindesk.com/business/2021/12/10/badgerdao-reveals-details-of-how-it-was-hacked-for-120m/ BadgerDAO Reveals Details of How It Was Hacked for $120M] (Dec 30)

[https://zengo.com/the-badgerdao-hack-what-really-happened-and-why-it-matters/ https://zengo.com/the-badgerdao-hack-what-really-happened-and-why-it-matters/] (Dec 30)

[https://rekt.news/badger-rekt/ Rekt - Badger - REKT] (May 31)

[https://twitter.com/TalBeerySec/status/1466501014262059017 @TalBeerySec Twitter] (Jul 22)

[https://cryptonews.com/news/badger-dao-appears-to-have-lost-over-usd-62m-in-an-attack.htm Badger DAO Appears to Have Lost Over USD 120M in an Attack] (Dec 1)

[https://cryptonews.com/news/santa-hackathon-visor-finance-marks-7th-hack-december.htm Santa Hackathon? Visor Finance Marks 7th Hack in December] (Dec 1)

← Older revision		Revision as of 11:47, 28 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/badgerdaomaliciouscodeinjected.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/badgerdaomaliciouscodeinjected.php}}
			{{Unattributed Sources}}

	[[File:Badgerdao.jpg\|thumb\|BadgerDAO]]BadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has een improved and 40% of funds have been recovered. There are suggestions of other measures to recover the rest.		[[File:Badgerdao.jpg\|thumb\|BadgerDAO]]BadgerDAO suffered a massive attack on their smart contract hot wallets. In this case, the vulnerability was not inherently in the contract, but they were tricked into adding an additional API connection, which allowed the attacker to inject malicious code. So far, the security of the smart contract has een improved and 40% of funds have been recovered. There are suggestions of other measures to recover the rest.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="thewebserv-4692" /><ref name="invezz-5020" /><ref name="cryptopotato-5021" /><ref name="badger-5022" /><ref name="badgerdaotwitter-5023" /><ref name="badger-5024" /><ref name="badger-5025" /><ref name="badgerapparchive-5026" /><ref name="etherscan-5027" /><ref name="badger-5028" /><ref name="badger-5029" /><ref name="badgerdocs-5030" /><ref name="googledoc-5031" /><ref name="badger-5032" /><ref name="theverge-5033" /><ref name="peckshieldtwitter-5034" /><ref name="coindesk-5035" /><ref name="zengo-5036" /><ref name="rektnews-7842" /><ref name="talbeerysectwitter-8681" /><ref name="cryptonews-9847" /><ref name="cryptonews-9850" />

	== About BadgerDAO ==		== About BadgerDAO ==
Line 131:		Line 133:

	== References ==		== References ==
	[https://thewebserv.com/business/bitmart-suspends-withdrawals-after-hackers-drained-almost-200-million-in-cryptocurrencies-using-a-stolen-private-key/ BitMart suspends withdrawals after hackers drained almost $200 million in cryptocurrencies using a stolen private key] (Dec 22)		<references><ref name="thewebserv-4692">[https://thewebserv.com/business/bitmart-suspends-withdrawals-after-hackers-drained-almost-200-million-in-cryptocurrencies-using-a-stolen-private-key/ BitMart suspends withdrawals after hackers drained almost $200 million in cryptocurrencies using a stolen private key] (Dec 23, 2021)</ref>

	[https://invezz.com/news/2021/12/06/bitmart-ceo-claims-stolen-private-keys-led-to-the-196m-hack/ BitMart CEO claims stolen private keys led to the $196M hack \| Invezz] (Dec 22)		<ref name="invezz-5020">[https://invezz.com/news/2021/12/06/bitmart-ceo-claims-stolen-private-keys-led-to-the-196m-hack/ BitMart CEO claims stolen private keys led to the $196M hack \| Invezz] (Dec 23, 2022)</ref>

	[https://cryptopotato.com/celsius-network-reportedly-lost-50-million-in-the-120-million-badgerdao-hack/ Celsius Network Reportedly Lost $50 Million in the $120 Million BadgerDAO Hack] (Dec 30)		<ref name="cryptopotato-5021">[https://cryptopotato.com/celsius-network-reportedly-lost-50-million-in-the-120-million-badgerdao-hack/ Celsius Network Reportedly Lost $50 Million in the $120 Million BadgerDAO Hack] (Dec 31, 2022)</ref>

	[https://badger.com/ Building Defi for Bitcoin - Badger] (Dec 30)		<ref name="badger-5022">[https://badger.com/ Building Defi for Bitcoin - Badger] (Dec 31, 2022)</ref>

	[https://twitter.com/BadgerDAO/status/1472026124523872260 @BadgerDAO Twitter] (Dec 30)		<ref name="badgerdaotwitter-5023">[https://twitter.com/BadgerDAO/status/1472026124523872260 @BadgerDAO Twitter] (Dec 31, 2022)</ref>

	[https://badger.com/news/turning-lights-on Turning the Lights Back On] (Dec 30)		<ref name="badger-5024">[https://badger.com/news/turning-lights-on Turning the Lights Back On] (Dec 31, 2022)</ref>

	[https://badger.com/technical-post-mortem BadgerDAO Exploit Technical Post Mortem] (Dec 30)		<ref name="badger-5025">[https://badger.com/technical-post-mortem BadgerDAO Exploit Technical Post Mortem] (Dec 31, 2022)</ref>

	[https://web.archive.org/web/20211129101319/https://app.badger.com/ Badger DAO \| Deposit & Earn on your Bitcoin] (Dec 30)		<ref name="badgerapparchive-5026">[https://web.archive.org/web/20211129101319/https://app.badger.com/ Badger DAO \| Deposit & Earn on your Bitcoin] (Dec 31, 2022)</ref>

	[https://etherscan.io/tx/0x951babdddbfbbba81bbbb7991a959d9815e80cc5d9418d10e692f41541029869 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Dec 30)		<ref name="etherscan-5027">[https://etherscan.io/tx/0x951babdddbfbbba81bbbb7991a959d9815e80cc5d9418d10e692f41541029869 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Dec 31, 2022)</ref>

	[https://badger.com/news/badger-security-upgrades Badger Security Upgrades] (Dec 30)		<ref name="badger-5028">[https://badger.com/news/badger-security-upgrades Badger Security Upgrades] (Dec 31, 2022)</ref>

	[https://badger.com/recovery-phase Recovery Phase] (Dec 30)		<ref name="badger-5029">[https://badger.com/recovery-phase Recovery Phase] (Dec 31, 2022)</ref>

	[https://docs.badger.com/badger-finance/ Setts Overview & Fees - Badger Finance] (Dec 30)		<ref name="badgerdocs-5030">[https://docs.badger.com/badger-finance/ Setts Overview & Fees - Badger Finance] (Dec 31, 2022)</ref>

	[https://docs.google.com/document/d/1nCrYyw4X4bX0XqZRzP3Tj5IF-goYoNSrOtMAWHIXjow/edit BadgerDAO Treasury Overview - Google Docs] (Dec 30)		<ref name="googledoc-5031">[https://docs.google.com/document/d/1nCrYyw4X4bX0XqZRzP3Tj5IF-goYoNSrOtMAWHIXjow/edit BadgerDAO Treasury Overview - Google Docs] (Dec 31, 2022)</ref>

	[https://badger.com/security-and-audits Security & Audits] (Dec 30)		<ref name="badger-5032">[https://badger.com/security-and-audits Security & Audits] (Dec 31, 2022)</ref>

	[https://www.theverge.com/2021/12/2/22814849/badgerdao-defi-120-million-hack-bitcoin-ethereum BadgerDAO hackers stole $120 million in crypto with a simple but effective attack - The Verge] (Dec 30)		<ref name="theverge-5033">[https://www.theverge.com/2021/12/2/22814849/badgerdao-defi-120-million-hack-bitcoin-ethereum BadgerDAO hackers stole $120 million in crypto with a simple but effective attack - The Verge] (Dec 31, 2022)</ref>

	[https://twitter.com/peckshield/status/1466294179676372992 @peckshield Twitter] (Dec 30)		<ref name="peckshieldtwitter-5034">[https://twitter.com/peckshield/status/1466294179676372992 @peckshield Twitter] (Dec 31, 2022)</ref>

	[https://www.coindesk.com/business/2021/12/10/badgerdao-reveals-details-of-how-it-was-hacked-for-120m/ BadgerDAO Reveals Details of How It Was Hacked for $120M] (Dec 30)		<ref name="coindesk-5035">[https://www.coindesk.com/business/2021/12/10/badgerdao-reveals-details-of-how-it-was-hacked-for-120m/ BadgerDAO Reveals Details of How It Was Hacked for $120M] (Dec 31, 2022)</ref>

	[https://zengo.com/the-badgerdao-hack-what-really-happened-and-why-it-matters/ https://zengo.com/the-badgerdao-hack-what-really-happened-and-why-it-matters/] (Dec 30)		<ref name="zengo-5036">[https://zengo.com/the-badgerdao-hack-what-really-happened-and-why-it-matters/ https://zengo.com/the-badgerdao-hack-what-really-happened-and-why-it-matters/] (Dec 31, 2022)</ref>

	[https://rekt.news/badger-rekt/ Rekt - Badger - REKT] (May 31)		<ref name="rektnews-7842">[https://rekt.news/badger-rekt/ Rekt - Badger - REKT] (May 31, 2022)</ref>

	[https://twitter.com/TalBeerySec/status/1466501014262059017 @TalBeerySec Twitter] (Jul 22)		<ref name="talbeerysectwitter-8681">[https://twitter.com/TalBeerySec/status/1466501014262059017 @TalBeerySec Twitter] (Jul 22, 2022)</ref>

	[https://cryptonews.com/news/badger-dao-appears-to-have-lost-over-usd-62m-in-an-attack.htm Badger DAO Appears to Have Lost Over USD 120M in an Attack] (Dec 1)		<ref name="cryptonews-9847">[https://cryptonews.com/news/badger-dao-appears-to-have-lost-over-usd-62m-in-an-attack.htm Badger DAO Appears to Have Lost Over USD 120M in an Attack] (Dec 1, 2022)</ref>

	[https://cryptonews.com/news/santa-hackathon-visor-finance-marks-7th-hack-december.htm Santa Hackathon? Visor Finance Marks 7th Hack in December] (Dec 1)		<ref name="cryptonews-9850">[https://cryptonews.com/news/santa-hackathon-visor-finance-marks-7th-hack-december.htm Santa Hackathon? Visor Finance Marks 7th Hack in December] (Dec 1, 2022)</ref></references>