Ribbon Finance Malicious DNS Hijack - Revision history

Azoundria: Blockchain analytics links added in.

2023-12-28T18:57:48Z

Blockchain analytics links added in.

← Older revision		Revision as of 12:57, 28 December 2023
Line 31:		Line 31:
	\|June 20th, 2022 3:05:42 AM		\|June 20th, 2022 3:05:42 AM
	\|First Malicious Contract		\|First Malicious Contract
	\|The very first smart contract is created by a wallet controlled from the attacker<ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First ~~Smart~~ Contract ~~Creation~~ - ~~EtherScan~~] (Feb 23, 2023)</ref>.		\|The very first smart contract is created by a wallet controlled from the attacker<ref name=":03">[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First Transaction Creating Malicious Contract 0x65a8...3b2f - Etherscan] (Feb 23, 2023)</ref>. Malicious contract 0x65a8...3b2f<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref> was created by wallet 0x5622...781a<ref name=":03" /><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref>.
	\|-		\|-
	\|June 20th, 2022		\|June 20th, 2022
Line 39:		Line 39:
	\|June 23rd, 2022 6:17:41 AM		\|June 23rd, 2022 6:17:41 AM
	\|Final Malicious Contract		\|Final Malicious Contract
	\|The final malicious smart contract is created by the attacker<ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Final Malicious Contract Creation - EtherScan] (Feb 23, 2023)</ref>.		\|The final malicious smart contract is created by the attacker<ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Final Malicious Contract Creation - EtherScan] (Feb 23, 2023)</ref>. <ref name=":4">[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Transaction Creating 0xdd49....c82b - Etherscan] (Feb 23, 2023)</ref><ref name=":4" />
	\|-		\|-
	\|June 23rd, 2022 1:02:00 PM		\|June 23rd, 2022 1:02:00 PM
Line 137:		Line 137:
	\|NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo<ref name="namecheapdomainvault6-10571" /> to "Titanium" tier at $19.88/mo<ref name="namecheapdomainvault7-10572" />.		\|NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo<ref name="namecheapdomainvault6-10571" /> to "Titanium" tier at $19.88/mo<ref name="namecheapdomainvault7-10572" />.
	\|}		\|}

			== Technical Details ==

			=== Blockchain Analytics ===
			Various notable addresses and transactions from Etherscan for further research/analysis:

			<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 Transaction Creating Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Transaction Creating 0xdd49....c82b - Etherscan] (Feb 23, 2023)</ref><ref>[https://etherscan.io/txs?a=0x56d3191ee65f1f76e4e902ec983c6420398d49c8 Transactions By Wallet 0x56d3...49c8 (Fake_Phishing5851) - Etherscan] (Dec 27, 2023)</ref><ref>[https://etherscan.io/address/0x4e1256734882c3deff95e963b6a0a658bb88899a Address 0x4e12...899a Who Created 0xf403...ae31 - Etherscan] (Dec 28, 2023)</ref><ref>[https://etherscan.io/address/0xf403a2c10b0b9fef8f0d4f931df5d86ad187ae31 Vanity Phishing Smart Contract 0xF403...AE31 - Etherscan] (Dec 7, 2o23)</ref><ref name="etherscanattackeraddress1-8877">[https://etherscan.io/address/0xb73261481064f717a63e6f295d917c28385af9aa Address 0xB732...F9Aa (Convex & Ribbon Phisher) - Etherscan] (Aug 23, 2022)</ref><ref>[https://etherscan.io/token/0x4e3fbd56cd56c3e72c1403e103b45db9da5b9d2b?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Convex Finance Tokens Received By Convex & Ribbon Phisher - Etherscan] (Dec 28, 2023)</ref>

	==Total Amount Lost==		==Total Amount Lost==

Azoundria: Another 30 minutes complete. Reviewing sources. Added a section on the rebranding.

2023-12-19T23:10:43Z

Another 30 minutes complete. Reviewing sources. Added a section on the rebranding.

Show changes

Azoundria: Opening description.

2023-04-02T06:06:31Z

Opening description.

← Older revision		Revision as of 00:06, 2 April 2023
Line 1:		Line 1:
	[[File:Ribbonfinance.jpg\|thumb\|Ribbon Finance]]		Ribbon Finance is a yield earning protocol. The service used NameCheap to host their primary domain where customers would interact with the service. On June 23rd, a request was made to change the DNS settings on their domain name, which was believed to be due to a vulnerability in NameCheap. This redirected the website to a phishing version, which looked identical to main version but requested approval on a new smart contract with a similar address. The new smart contract allowed the attacker to steal approved funds and was active on the site for a few hours, plus DNS propagation time. While multiple wallet addresses gave approvals, it was reported that only two users lost funds. There hasn't been any public statement on whether Ribbon Finance will assist those users.[[File:Ribbonfinance.jpg\|thumb\|Ribbon Finance]]

Azoundria: Fixing Nalin Gupta, and adding speculation about further domains.

2023-04-02T05:50:28Z

Fixing Nalin Gupta, and adding speculation about further domains.

← Older revision		Revision as of 23:50, 1 April 2023
Line 86:		Line 86:
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT
	\|Attacks Reported With Screenshots		\|Attacks Reported With Screenshots
	\|Twitter user ~~Nathan~~ Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 ~~Nathan~~ Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.		\|Twitter user Nalin Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nalin Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
			\|-
			\|June 24th, 2022 7:24:00 AM MDT
			\|Speculation About Further Domains
			\|Further speculation arises that some other domains may be related<ref>[https://twitter.com/nalingupta01/status/1540325110720380928 <nowiki>Nalin Gupta - "It does seem some others might be affected tho[ugh]" - Twitter</nowiki>] (Apr 1, 2023)</ref>. The list referenced are cryptocurrency phishing websites and it does not appear that any of those domains are related to the DNS attack<ref>[https://twitter.com/idclickthat/status/1540200001112096768 idclickthat - "crypto phish" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM		\|June 24th, 2022 7:29:00 AM

Azoundria: nothing to worry about quote

2023-04-02T04:09:11Z

nothing to worry about quote

← Older revision		Revision as of 22:09, 1 April 2023
Line 99:		Line 99:
	\|Free DomainVault Monitoring		\|Free DomainVault Monitoring
	\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.		\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.
			\|-
			\|June 24th, 2022 10:32:00 AM MDT
			\|Nothing To Worry About
			\|NameCheap assures via Twitter that "[t]here is nothing to worry about" and they will "keep investigating"<ref>[https://twitter.com/Namecheap/status/1540372203627216898 NameCheap - "There is nothing to worry about; we keep investigating" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 11:21:00 AM		\|June 24th, 2022 11:21:00 AM

Azoundria: Tweet used as support for 2FA being employed too.

2023-04-01T20:55:28Z

Tweet used as support for 2FA being employed too.

← Older revision		Revision as of 14:55, 1 April 2023
Line 15:		Line 15:
	The account of a customer support agent for NameCheap was reportedly hacked<ref name="namecheapceotwitter3-10566" />.		The account of a customer support agent for NameCheap was reportedly hacked<ref name="namecheapceotwitter3-10566" />.

	This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], Ribbon Finance, [[DeFi Saver Malicious DNS Hijack\|Defi Saver]], and [[AllBridge Malicious DNS Hijack\|AllBridge]]<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings<ref>[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref>.		This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], Ribbon Finance, [[DeFi Saver Malicious DNS Hijack\|Defi Saver]], and [[AllBridge Malicious DNS Hijack\|AllBridge]]<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings<ref>[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref><ref name=":8" />.

	The issue was quickly corrected by the Ribbon Finance team, but not before 2 users were affected<ref name=":0">[https://twitter.com/ribbonfinance/status/1540250826156871681 Ribbon Finance Reports Remedy - Twitter] (Feb 22, 2023)</ref>.		The issue was quickly corrected by the Ribbon Finance team, but not before 2 users were affected<ref name=":0">[https://twitter.com/ribbonfinance/status/1540250826156871681 Ribbon Finance Reports Remedy - Twitter] (Feb 22, 2023)</ref>.
Line 82:		Line 82:
	\|June 24th, 2022 6:14:00 AM MDT		\|June 24th, 2022 6:14:00 AM MDT
	\|All Attacks Reported Together		\|All Attacks Reported Together
	\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref>[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.		\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref name=":8">[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT

Azoundria: Attacks reported together updated again with another Twitter post.

2023-04-01T20:53:02Z

Attacks reported together updated again with another Twitter post.

← Older revision		Revision as of 14:53, 1 April 2023
Line 79:		Line 79:
	\|Telegram Group Operating		\|Telegram Group Operating
	\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.		\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.
			\|-
			\|June 24th, 2022 6:14:00 AM MDT
			\|All Attacks Reported Together
			\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref>[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT
	\|~~All~~ Attacks Reported ~~Together~~		\|Attacks Reported With Screenshots
	\|Twitter user Nathan Gupta is the first to publicly ~~report~~ all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.		\|Twitter user Nathan Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM		\|June 24th, 2022 7:29:00 AM

Azoundria: Attacks Reported Together On All DNS Wiki Pages

2023-04-01T20:45:05Z

Attacks Reported Together On All DNS Wiki Pages

← Older revision		Revision as of 14:45, 1 April 2023
Line 79:		Line 79:
	\|Telegram Group Operating		\|Telegram Group Operating
	\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.		\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.
			\|-
			\|June 24th, 2022 7:00:00 AM MDT
			\|All Attacks Reported Together
			\|Twitter user Nathan Gupta is the first to publicly report all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM		\|June 24th, 2022 7:29:00 AM
	\|~~All~~ Attacks Reported Together		\|Attacks Reported Together Again
	\|Twitter user Tommy Famous reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.		\|Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 10:01:00 AM		\|June 24th, 2022 10:01:00 AM

Azoundria: Completing RIbbon Finance Ultimate Outcome, Total Amount Recovered, and Ongoing Developments, no longer under construction

2023-03-26T00:27:05Z

Completing RIbbon Finance Ultimate Outcome, Total Amount Recovered, and Ongoing Developments, no longer under construction

← Older revision		Revision as of 18:27, 25 March 2023
Line 1:		Line 1:
	~~{{Case Study Under Construction}}~~[[File:Ribbonfinance.jpg\|thumb\|Ribbon Finance]]		[[File:Ribbonfinance.jpg\|thumb\|Ribbon Finance]]


Line 102:		Line 102:
	\|June 25th, 2022 4:14:00 AM		\|June 25th, 2022 4:14:00 AM
	\|Developer Trying To Get In Contact		\|Developer Trying To Get In Contact
	\|Ribbon Finance developer kenchangh<ref>[https://twitter.com/kenchangh kenchangh - "Dev @RibbonFinance. We need to build Galt's Gulch in Cyberspace." - Twitter] (Mar 23, 2023)</ref> appears to be trying to get in contact with the NameCheap CEO<ref>[https://twitter.com/kenchangh/status/1540639477449641984 kenchangh - "hi @NamecheapCEO, can I DM you on behalf of @ribbonfinance?" - Twitter] (Mar 23, 2023)</ref>.		\|Ribbon Finance developer kenchangh<ref>[https://twitter.com/kenchangh kenchangh - "Dev @RibbonFinance. We need to build Galt's Gulch in Cyberspace." - Twitter] (Mar 23, 2023)</ref> appears to be trying to get in contact with the NameCheap CEO<ref name=":6">[https://twitter.com/kenchangh/status/1540639477449641984 kenchangh - "hi @NamecheapCEO, can I DM you on behalf of @ribbonfinance?" - Twitter] (Mar 23, 2023)</ref>.
	\|-		\|-
	\|June 25th, 2022		\|June 25th, 2022
Line 114:		Line 114:
	\|July 2nd, 2022 3:25:00 AM		\|July 2nd, 2022 3:25:00 AM
	\| Founder Trying To Get In Contact		\| Founder Trying To Get In Contact
	\|Ribbon Finance founder juliankoh<ref>[https://twitter.com/juliankoh juliankoh - "janitor & community manager @ribbonfinance" - Twitter] (Mar 19, 2023)</ref> appears to be trying to get in contact with the NameCheap CEO<ref>[https://twitter.com/juliankoh/status/1543164021519446016 "juliankoh - trying to get in touch regarding the @ribbonfinance situation, i am one of the founders" - Reddit] (Mar 19, 2023)</ref>.		\|Ribbon Finance founder juliankoh<ref>[https://twitter.com/juliankoh juliankoh - "janitor & community manager @ribbonfinance" - Twitter] (Mar 19, 2023)</ref> appears to be trying to get in contact with the NameCheap CEO<ref name=":7">[https://twitter.com/juliankoh/status/1543164021519446016 "juliankoh - trying to get in touch regarding the @ribbonfinance situation, i am one of the founders" - Reddit] (Mar 19, 2023)</ref>.
	\|-		\|-
	\|July 2nd, 2022		\|July 2nd, 2022
Line 135:		Line 135:
	The takeover prompted 2 users to approve malicious contracts for vault deposits.		The takeover prompted 2 users to approve malicious contracts for vault deposits.

	All funds on the vault contract are unaffected.</blockquote>A Telegram group was set up for communication between the different affected protocols<ref name=":4">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>. MistTrack was one of the first to respond to the situation, highlighting a transaction for the theft of 16.5 WBTC<ref name=":2" />.<blockquote>On-chain analysis showed that it was the same attacker as Convex. One victim lost 16.5 WBTC.</blockquote>~~How did the various parties involved (firm, platform, management, and/~~or ~~affected individual(s)) deal with~~ the ~~events? Were services shut down? Were announcements made? Were~~ groups ~~formed?~~		All funds on the vault contract are unaffected.</blockquote>A Telegram group was set up for communication between the different affected protocols<ref name=":4">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>. MistTrack was one of the first to respond to the situation, highlighting a transaction for the theft of 16.5 WBTC<ref name=":2" />.<blockquote>On-chain analysis showed that it was the same attacker as Convex. One victim lost 16.5 WBTC.</blockquote>It is unclear if Ribbon Finance was in contact with NameCheap or part of the earlier groups prior to their first public record of trying to reach NameCheap on June 25th<ref name=":6" />.

	==Ultimate Outcome==		==Ultimate Outcome==
	The NameCheap CEO ultimately responded on Twitter to explain that there was a hacked or compromised customer support agent and all access was removed from them<ref name="namecheapceotwitter1-8884" />. He also offered completely free Domain Vault monitoring to all affected services<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.<blockquote>"We've traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."		The NameCheap CEO ultimately responded on Twitter to explain that there was a hacked or compromised customer support agent and all access was removed from them<ref name="namecheapceotwitter1-8884" />. He also offered completely free Domain Vault monitoring to all affected services<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.<blockquote>"We've traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."

	"In the meantime we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring."</blockquote>No further communication ~~rom~~ Ribbon Finance on the matter could be located on Twitter.		"In the meantime we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring."</blockquote>Records can be found of the Ribbon Finance team members trying to reach NameCheap on June 25th<ref name=":6" /> and July 2nd<ref name=":7" />. No further communication to the community from Ribbon Finance on the matter could be located on Twitter.

	==Total Amount Recovered==		==Total Amount Recovered==
	The total amount recovered is unknown.		The total amount recovered is unknown. It is suspected that nothing was done to assist the affected users in this case.

	~~What funds were recovered? What funds were reimbursed for those~~ affected users?

	==Ongoing Developments==		==Ongoing Developments==
	~~What parts of this case are still remaining~~ to ~~be concluded?~~		It is unclear if any further investigation is underway to identify and recover the funds from the attacker.

	== Individual Prevention Policies==		== Individual Prevention Policies==

Azoundria: Total Amount Lost adding second transaction to Total Amount Lost.

2023-03-26T00:20:39Z

Total Amount Lost adding second transaction to Total Amount Lost.

← Older revision		Revision as of 18:20, 25 March 2023
Line 60:		Line 60:
	\|Similarly affected Convex Finance first posts on Twitter to announce the DNS hijacking. They list 5 addresses which are affected, that investigation is still ongoing, and that the issue is "remediated" for their service<ref name="convexannouncesdnshijacktwitter-8893">[https://twitter.com/ConvexFinance/status/1540104036229185536 @ConvexFinance Twitter] (Aug 24, 2022)</ref><ref name="cryptonomist-88702">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.		\|Similarly affected Convex Finance first posts on Twitter to announce the DNS hijacking. They list 5 addresses which are affected, that investigation is still ongoing, and that the issue is "remediated" for their service<ref name="convexannouncesdnshijacktwitter-8893">[https://twitter.com/ConvexFinance/status/1540104036229185536 @ConvexFinance Twitter] (Aug 24, 2022)</ref><ref name="cryptonomist-88702">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.
	\|-		\|-
	\|June 23rd, 2022 9:57:59 PM		\|June 23rd, 2022 9:32:48 PM MDT
			\|Initial USDC Theft
			\|A smaller transfer of 110 USDC is performed on another user who approved the phishing smart contract<ref name=":5">[https://etherscan.io/tx/0xcbafe5323e8e49f3261f2e6e243d46b065400223bb5f8de839e6f2376b1d73f6 Malicious Transfer of 110 USDC to Attacker - Etherscan] (Mar 25, 2025)</ref>.
			\|-
			\|June 23rd, 2022 9:57:59 PM MDT
	\|Massive WBTC Theft		\|Massive WBTC Theft
	\|A total of 16.50942255 WBTC are transferred from one user and victim of the DNS exploit to the attacker<ref name=":1">[https://etherscan.io/tx/0xd09057f1fdb3fa97d0ed7e8ebd8fd31dd9a0b5b61a29a22b46985d6217510850 Theft Transaction For 16.5 WBTC - Etherscan] (Feb 22, 2023)</ref><ref>[https://etherscan.io/token/0x2260fac5e5542a773aa44fbcfedf7c193bc2c599?a=0xda981ae7d29e6c97da4d486dec90e41aa02454ef Overview of WBTC Related Transactions - Etherscan] (Mar 8, 2023)</ref>.		\|A total of 16.50942255 WBTC are transferred from one user and victim of the DNS exploit to the attacker<ref name=":1">[https://etherscan.io/tx/0xd09057f1fdb3fa97d0ed7e8ebd8fd31dd9a0b5b61a29a22b46985d6217510850 Theft Transaction For 16.5 WBTC - Etherscan] (Feb 22, 2023)</ref><ref>[https://etherscan.io/token/0x2260fac5e5542a773aa44fbcfedf7c193bc2c599?a=0xda981ae7d29e6c97da4d486dec90e41aa02454ef Overview of WBTC Related Transactions - Etherscan] (Mar 8, 2023)</ref>.
Line 122:		Line 126:
	MistTrack reports one of the users lost 16.5 WBTC<ref name=":2" />. Blockchain analysis shows that the exact amount was 16.50942255 WBTC<ref name=":1" />. The closing market price of wrapped bitcoin on June 23rd, 2022 was $21,057.95 USD<ref>[https://coinmarketcap.com/currencies/wrapped-bitcoin/historical-data/ Wrapped Bitcoin Historic Prices - CoinMarketCap] (Feb 22, 2023)</ref>. This creates a loss estimate of $347,654.59 USD.		MistTrack reports one of the users lost 16.5 WBTC<ref name=":2" />. Blockchain analysis shows that the exact amount was 16.50942255 WBTC<ref name=":1" />. The closing market price of wrapped bitcoin on June 23rd, 2022 was $21,057.95 USD<ref>[https://coinmarketcap.com/currencies/wrapped-bitcoin/historical-data/ Wrapped Bitcoin Historic Prices - CoinMarketCap] (Feb 22, 2023)</ref>. This creates a loss estimate of $347,654.59 USD.

	~~How much was lost and how was~~ it ~~calculated? If there are conflicting reports~~, which ~~are accurate and where does the discrepancy lie?~~		While Ribbon Finance does not express any indication of the second affected user, it is most likely a smaller transaction for 110 USDC<ref name=":5" />.

			This creates a total loss estimate of $347,764.59 USD, which can be estimated to $348,000 USD.

	==Immediate Reactions==		==Immediate Reactions==