Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/loopringofficialguardian2favulnerability.php}} {{Unattributed Sources}} Loopring Logo/HomepageLoopring provides wallet software, which has a default setting of only a single official guardian. While the software provided daily notices requesting users to set up additional guardians, and multiple sources online including a post from Vitalik Buterin provided ad..."

2024-09-18T19:40:00Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/loopringofficialguardian2favulnerability.php}} {{Unattributed Sources}} thumb|Loopring Logo/HomepageLoopring provides wallet software, which has a default setting of only a single official guardian. While the software provided daily notices requesting users to set up additional guardians, and multiple sources online including a post from Vitalik Buterin provided ad..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/loopringofficialguardian2favulnerability.php}}
{{Unattributed Sources}}

[[File:Loopring.jpg|thumb|Loopring Logo/Homepage]]Loopring provides wallet software, which has a default setting of only a single official guardian. While the software provided daily notices requesting users to set up additional guardians, and multiple sources online including a post from Vitalik Buterin provided additional guidance on doing so, many users chose not to and remained with the default security setup. On June 8th, a malicious actor found a way to bypass the two-factor authentication which Loopring provided through their official guardian. This allowed them to access many wallets of Loopring users, which they subsequently drained. Loopring has postponed an upgrade to their smart contract and is reportedly working with law enforcement, centralized exchanges, and different security experts to recover lost funds.<ref name="slowmisthackedarchive-14322" /><ref name="loopringorgtwitter-14364" /><ref name="etherscan-14365" /><ref name="etherscan-14366" /><ref name="etherscan-14367" /><ref name="etherscan-14368" /><ref name="etherscan-14369" /><ref name="loopringorgtwitter-14370" /><ref name="redditold-14371" /><ref name="loopringorgtwitter-14372" /><ref name="loopringorgtwitter-14373" />

== About Loopring ==
"Loopring is a software running on Ethereum that aims to incentivize a global network of users to operate a platform that enables the creation of new types of crypto asset exchanges."

High transaction fees are "exactly what Loopring aims to remedy, by delivering a digital economy that empowers its users while still giving them complete control over their assets. With Loopring, people no longer have to sacrifice efficiency and affordability to take advantage of Ethereum’s network security."

"Loopring (LRC) is an Ethereum Layer-2 scaling protocol that enables the building of decentralized exchanges which rival centralized exchanges in terms of performance. The network can handle up to 1,000 times more trades per second than Ethereum with each one costing a mere fraction of a cent."

"Loopring's zkRollup L2 solution offers the same security guarantees as Ethereum mainnet, with a big scalability boost: throughput increased by 1000x, and cost reduced to just 0.1% of L1. Ethereum is now unleashed. One year ago, we launched the first zkRollup on Ethereum - now we put its power in your pocket. Smooth orderbook trading, AMMs, and global payments, right from the Loopring wallet."

"Most notably, Loopring claims its platform will allow exchanges built on top of it to sidestep the slow speeds and high costs associated with decentralized exchanges on Ethereum through the use of a newer type of cryptography called zero-knowledge rollups, or zkRollups."

== The Reality ==
"This is exactly why the app asks you to setup multiple guardians and even notifies you to do so if you haven't every time you log in, that's alot of people who ignored the warnings daily and this unfortunate event happened."

== What Happened ==
"Loopring Smart Wallets were targeted in a security breach. The attack exploited wallets with" the Loopring Official Guardian as their only guardian.
{| class="wikitable"
|+Key Event Timeline - Loopring Official Guardian 2FA Vulnerability
!Date
!Event
!Description
|-
|June 8th, 2024 11:41:23 AM MDT
|First Malicious Withdrawal
|This transaction represents the most likely earliest malicious withdrawal on one of the reported theft wallets.
|-
|June 9th, 2024 7:13:00 AM MDT
|Loopring Twitter Announcement
|Loopring announces the events on Twitter. According to their announcement, they have "temporarily suspended Guardian-related and 2FA-related operations".
|-
|June 10th, 2024 6:21:00 AM MDT
|Contact Address Provided
|Loopring provides a contact address, and notes that they are actively working with centralized exchanges, security experts, and law enforcement on fund recovery.
|-
|June 12th, 2024 5:05:00 AM MDT
|Launch Postponed
|Loopring announces that their smart contract upgrade is being postponed due to the breach. They will announce the date in the future.
|-
|June 13th, 2024 8:59:00 AM MDT
|Loopring Guardian Guide
|Loopring publishes a tweet referencing a post by Vitalik on proper guardian setup for Loopring wallets. This recommends at least 3 guardians and that they shouldn't know each other.
|}

== Technical Details ==
SlowMist estimates $5m.

== Total Amount Lost ==
The total amount lost has been estimated at $5,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
"Ethereum Layer 2 protocol Loopring posted on Twitter that the some Loopring Smart Wallets were targeted in a security breach. The attack exploited wallets with only one Guardian, specifically the Loopring Official Guardian. The hacker initiated a Recovery process, falsely posing as the wallet owner to reset ownership and withdraw assets. The attack succeeded by compromising Loopring's 2FA service, allowing the hacker to impersonate the wallet owner and gain approval for the Recovery from the Official Guardian. Subsequently, the attacker transferred assets out of the affected wallets."

"A few hours ago, some Loopring Smart Wallets were targeted in a security breach. The attack exploited wallets with only one Guardian, specifically the Loopring Official Guardian. The hacker initiated a Recovery process, falsely posing as the wallet owner to reset ownership and withdraw assets.

The attack succeeded by compromising Loopring's 2FA service, allowing the hacker to impersonate the wallet owner and gain approval for the Recovery from the Official Guardian. Subsequently, the attacker transferred assets out of the affected wallets.

We are actively collaborating with Mist security experts to determine how our 2FA service was compromised. To protect our users, we have temporarily suspended Guardian-related and 2FA-related operations. Following this action, the compromise has ceased.

Loopring is working with law enforcement and professional security teams to track down the perpetrator. We will continue to provide updates as soon as the investigation progresses."

== Ultimate Outcome ==
"Due to a recent security breach involving Loopring's two-factor authentication (2FA) service, the pre-scheduled smart contract auto-upgrade on the Ethereum mainnet, originally set for June 12th, has been postponed. We will proceed with the upgrade at a later date and will announce this date ahead of time."

"If you've experienced asset loss during the Loopring Smart Wallet compromise event - please contact us at foundation at loopring dot org

We are actively collaborating with security experts, centralized exchanges (CEX), and law enforcement to recover the lost funds. Any progress will be communicated through our official channels immediately.

Also - be aware and watch out for impersonators and scammers in the replies who are trying to capitalize off this event."

== Total Amount Recovered ==
"If you've experienced asset loss during the Loopring Smart Wallet compromise event - please contact us at foundation at loopring dot org

We are actively collaborating with security experts, centralized exchanges (CEX), and law enforcement to recover the lost funds. Any progress will be communicated through our official channels immediately."

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-14322">[https://web.archive.org/web/20240610222253/https://hacked.slowmist.io/ SlowMist Hacked - SlowMist Zone] (Accessed Jun 18, 2024)</ref>

<ref name="loopringorgtwitter-14364">[https://twitter.com/loopringorg/status/1799791898296451515 @loopringorg Twitter] (Accessed Jun 19, 2024)</ref>

<ref name="etherscan-14365">[https://etherscan.io/address/0x44f887cfbd667cb2042dd55ab1d8951c94bb0102 Address 0x44f887cfbd667cb2042dd55ab1d8951c94bb0102 | Etherscan] (Accessed Jun 19, 2024)</ref>

<ref name="etherscan-14366">[https://etherscan.io/tokentxns?a=0x44f887cfbd667cb2042dd55ab1d8951c94bb0102 Token Transfer | Etherscan] (Accessed Jun 19, 2024)</ref>

<ref name="etherscan-14367">[https://etherscan.io/tx/0xf0a02e3dc32e380f5fbc832981963277f7b2ce9345040ddf1f3016724b84e251 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Jun 19, 2024)</ref>

<ref name="etherscan-14368">[https://etherscan.io/address/0xbacef3a142e39f14f4f15e22e9248ee4141af18f Address 0xbacef3a142e39f14f4f15e22e9248ee4141af18f | Etherscan] (Accessed Jun 19, 2024)</ref>

<ref name="etherscan-14369">[https://etherscan.io/txs?a=0xbacef3a142e39f14f4f15e22e9248ee4141af18f Ethereum Transactions Information | Etherscan] (Accessed Jun 19, 2024)</ref>

<ref name="loopringorgtwitter-14370">[https://twitter.com/loopringorg/status/1801268180364530172 @loopringorg Twitter] (Accessed Jun 19, 2024)</ref>

<ref name="redditold-14371">[https://old.reddit.com/r/ethereum/comments/11tijiv/how_i_think_about_choosing_guardians_for_multisig/ https://old.reddit.com/r/ethereum/comments/11tijiv/how_i_think_about_choosing_guardians_for_multisig/] (Accessed Jun 19, 2024)</ref>

<ref name="loopringorgtwitter-14372">[https://twitter.com/loopringorg/status/1800846819666108482 @loopringorg Twitter] (Accessed Jun 19, 2024)</ref>

<ref name="loopringorgtwitter-14373">[https://twitter.com/loopringorg/status/1800141336470810660 @loopringorg Twitter] (Accessed Jun 19, 2024)</ref></references>

Loopring Official Guardian 2FA Vulnerability - Revision history