Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/starknetdiscordaccountcompromisephishing.php}} {{Unattributed Sources}} Starknet Logo/HomepageStarknet aims to create a more secure layer 2 Ethereum scaling solution with a custom programming language for users. Through undisclosed means, the Discord channel of Starknet was compromised and phishing links were posted for hours, promising users an airdrop of St..."

2024-10-25T20:05:16Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/starknetdiscordaccountcompromisephishing.php}} {{Unattributed Sources}} thumb|Starknet Logo/HomepageStarknet aims to create a more secure layer 2 Ethereum scaling solution with a custom programming language for users. Through undisclosed means, the Discord channel of Starknet was compromised and phishing links were posted for hours, promising users an airdrop of St..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/starknetdiscordaccountcompromisephishing.php}}
{{Unattributed Sources}}

[[File:Starknet.jpg|thumb|Starknet Logo/Homepage]]Starknet aims to create a more secure layer 2 Ethereum scaling solution with a custom programming language for users. Through undisclosed means, the Discord channel of Starknet was compromised and phishing links were posted for hours, promising users an airdrop of Starknet tokens if they approved a malicious transaction. It appears that there were no victims in this case, and no funds were lost from users.<ref name="slowmisthackedarchive-15200" /><ref name="starknettwitter-15201" /><ref name="starknet-15202" /><ref name="starknetdocs-15203" /><ref name="miki777twitter-15204" /><ref name="andriypaskatwitter-15205" /><ref name="starknetzhtwitter-15206" /><ref name="andriypaskatwitter-15207" /><ref name="andriypaskatwitter-15208" /><ref name="andriypaskatwitter-15209" /><ref name="andriypaskatwitter-15210" /><ref name="andriypaskatwitter-15211" /><ref name="andriypaskatwitter-15212" /><ref name="andriypaskatwitter-15213" /><ref name="andriypaskatwitter-15214" /><ref name="andriypaskatwitter-15215" /><ref name="kingsleyuezetwitter-15216" /><ref name="crypto6717twitter-15217" /><ref name="andriypaskatwitter-15218" /><ref name="fricobentwitter-15219" /><ref name="andriypaskatwitter-15220" /><ref name="infinityhedge07twitter-15221" /><ref name="paramatikhabertwitter-15222" /><ref name="metaversenews01twitter-15223" /><ref name="altcoinerstwitter-15224" /><ref name="masteroncryptotwitter-15225" /><ref name="jonkriptotwitter-15226" /><ref name="lauripeltotwitter-15227" /><ref name="paceking1twitter-15228" /><ref name="0xkodawaritwitter-15229" /><ref name="akashbitcoinstwitter-15230" /><ref name="arizonyaatwitter-15231" /><ref name="islakwcterliitwitter-15232" /><ref name="cryptogurkhatwitter-15233" /><ref name="spreekawaytwitter-15234" /><ref name="miixcapitalcntwitter-15235" /><ref name="trendsgemtwitter-15236" /><ref name="goplussecwarextwitter-15237" />

== About Starknet ==
"Starknet is the secure scaling technology bringing Ethereum’s benefits to the world."

"Starknet is a permissionless Validity-Rollup, also known as a zero-knowledge rollup (ZK rollup) for Ethereum. As a Layer 2 (L2) blockchain, Starknet enables any dApp to achieve massive computation scale without compromising on Ethereum’s composability and security.

Starknet aims to achieve secure, low-cost transactions and high performance by using the STARK cryptographic proof system. Starknet contracts and the Starknet OS are written in Cairo, a custom-built and specialized programming language."

"Starknet utilizes the power of STARK technology to ensure computational integrity. By validating off-chain transactions with advanced math and cryptography, Starknet overcomes Ethereum’s scalability limitations. Starknet is a Validity Rollup that provides unlimited scale while retaining Ethereum’s security and decentralization."

"Starknet offers efficient and user-friendly experiences by employing Native Account Abstraction. All accounts are smart accounts: their behavior is determined by their developers rather than at the protocol level. This means unparalleled flexibility in account management. Developers can customize their applications beyond protocol constraints to elevate user experience and security."

"Starknet is home to the fastest-growing Layer 2 (L2) developer community due to its novel approach to scaling Ethereum and making it economically feasible to build even the most complex dApps. The Developer Hub provides a variety of manuals and resources for builders, by builders, on how to get started on Starknet."

"Did you miss our first Starknet Provisions Airdrop? Don't worry - There's still more! Starting from today, we will be releasing 10% of our remaining $STRK tokens to the community with a Claimdrop. Check eligibility and claim your allocation below."

== The Reality ==
"Did you miss our first Starknet Provisions Airdrop? Don't worry - There's still more! Starting from today, we will be releasing 10% of our remaining $STRK tokens to the community with a Claimdrop. Check eligibility and claim your allocation below."

== What Happened ==
The Discord of the Starknet team was compromised, and a phishing attack attempted to trick users into signing malicious transactions.
{| class="wikitable"
|+Key Event Timeline - Starknet Discord Account Compromise Phishing
!Date
!Event
!Description
|-
|July 29th, 2024 3:52:00 AM MDT
|Cairo GPT Bot Unveiled
|A new Cairo GPT bot is unveiled on the Discord channel. There are a series of promotions aroung this time to engage the community further and get more participation.
|-
|August 1st, 2024 12:36:00 PM MDT
|Tweet About Compromise
|The team posts on Twitter to notify their community about the exploited Discord account, and warn them against clicking on any links which may be present in the Discord channel.
|-
|August 1st, 2024 12:44:00 PM MDT
|Tweet Blocked User
|A user reports they were previously blocked from Twitter, so they can't see the notice, however they believe the Discord is compromised.
|-
|August 1st, 2024 12:57:00 PM MDT
|Discord Still Compromised
|A Tweet notes that the Discord channel is still compromised and shares a screenshot of the links being posted.
|-
|August 1st, 2024 1:21:00 PM MDT
|Warn Agaisnt Interaction
|A user warns against interacting with the Discord server. This suggests that is may still be compromised, but does not confirm that they've seen any malicious posts still present on it.
|-
|August 1st, 2024 1:23:00 PM MDT
|Akash Majumder Tweet
|Akash Majumder reports that the Discord has been hacked. There is no indication whether the Discord is still displaying phishing links at this time.
|-
|August 1st, 2024 9:43:00 PM MDT
|Still Working To Resolve
|A Tweet from MIIX Capital has a summary of various news stories and reports that the Starknet team is still working to resolve the issue. It's unclear if the Discord may have been recovered at this point.
|-
|August 2nd, 2024 4:50:00 AM MDT
|iscord Compromise Warning
|Another warning tweet by GoPlus Security Ware warns about interacting with the compromised Discord. While it suggests the Discord is still compromised, there is no screenshot or specific mention of posts still present on the Discord in this post. This post includes numerous generic steps that users should take to secure themselves.
|-
|August 2nd, 2024 6:39:00 AM MDT
|Discord Compromise Warning
|Another warning tweet by TrendsGem warns about interacting with the compromised Discord. While it suggests the Discord is still compromised, there is no screenshot or specific mention of posts still present on the Discord in this post.
|-
|August 2nd, 2024 6:53:00 AM MDT
|Jon Kripto Tweet
|A Twitter username Jon Kripto reports that the Discord was hacked. It's unclear if the issue has been resolved at this time.
|-
|August 2nd, 2024 7:37:00 AM MDT
|Discord Presently Hacked
|A Tweet from AltCoiners.live claims that the Discord is presently hacked, however it is unclear if anyone from their team has actually been to the Discord to confirm it, or are just reporting on the news of the prior hack.
|-
|August 3rd, 2024 11:02:00 AM MDT
|Update From Starknet
|The Starknet team reports that they "have rebuilt all of the channels, and the server is now live again with enhanced security features and improved channel organization". They are presently undergoing a security audit. This post reports that there is believed to be no damage to the community from the attack.
|-
|August 5th, 2024 2:26:00 AM MDT
|Back And More Secure
|The Starknet team announces that they are now back and that the server is more secure than ever.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
Reportedly none.

No funds were lost.

== Immediate Reactions ==
"Our Discord is currently compromised. Please do not interact with the server, click any links, or respond to any messages until further notice. We are working to resolve the issue and will provide updates through official channels. Stay vigilant and protect your information."

== Ultimate Outcome ==
"On Thursday evening the Starknet Discord came under attack. While the attackers were able to temporarily take over the server and post malicious links, we were able to quickly regain control.

The attacker’s goal was to scam users through these links, but through the quick work of StarkWare & SNF security teams and wallet partners we were able to prevent any harm to the community from the attack.

We have rebuilt all of the channels, and the server is now live again with enhanced security features and improved channel organization. We are also conducting a security audit and welcome your feedback on the updated channel layout."

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-15200">[https://web.archive.org/web/20240830161218/https://hacked.slowmist.io/?c=&page=2 SlowMist Hacked - SlowMist Zone] (Accessed Sep 3, 2024)</ref>

<ref name="starknettwitter-15201">[https://twitter.com/Starknet/status/1819079824851320990 @Starknet Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="starknet-15202">[https://www.starknet.io/ Starknet | Secure Scaling Technology Bringing Ethereum’s Benefits Worldwide] (Accessed Sep 3, 2024)</ref>

<ref name="starknetdocs-15203">[https://docs.starknet.io/ Overview :: Starknet documentation] (Accessed Sep 3, 2024)</ref>

<ref name="miki777twitter-15204">[https://twitter.com/_Miki777/status/1817135025969676314 @_Miki777 Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15205">[https://twitter.com/andriypaska/status/1817305083715219735 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="starknetzhtwitter-15206">[https://twitter.com/Starknet_ZH/status/1817027412687049155 @Starknet_ZH Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15207">[https://twitter.com/andriypaska/status/1817656446307496179 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15208">[https://twitter.com/andriypaska/status/1818022165247148347 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15209">[https://twitter.com/andriypaska/status/1817655552216031738 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15210">[https://twitter.com/andriypaska/status/1817302534853153077 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15211">[https://twitter.com/andriypaska/status/1817656964710813718 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15212">[https://twitter.com/andriypaska/status/1817303360019599628 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15213">[https://twitter.com/andriypaska/status/1818020534246052216 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15214">[https://twitter.com/andriypaska/status/1817648745745392042 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15215">[https://twitter.com/andriypaska/status/1818023166427754817 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="kingsleyuezetwitter-15216">[https://twitter.com/kingsleyueze/status/1817195540976672944 @kingsleyueze Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="crypto6717twitter-15217">[https://twitter.com/Crypto6717/status/1817549265905819828 @Crypto6717 Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15218">[https://twitter.com/andriypaska/status/1817652839889420749 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="fricobentwitter-15219">[https://twitter.com/Fricoben/status/1817860643632148622 @Fricoben Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="andriypaskatwitter-15220">[https://twitter.com/andriypaska/status/1818024078025916718 @andriypaska Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="infinityhedge07twitter-15221">[https://twitter.com/infinityhedge07/status/1819080966775943379 @infinityhedge07 Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="paramatikhabertwitter-15222">[https://twitter.com/ParamatikHaber/status/1819247590128365976 @ParamatikHaber Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="metaversenews01twitter-15223">[https://twitter.com/Metaversenews01/status/1819198164001608035 @Metaversenews01 Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="altcoinerstwitter-15224">[https://twitter.com/alt_coiners/status/1819367026336379191 @alt_coiners Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="masteroncryptotwitter-15225">[https://twitter.com/masteroncrypto/status/1819249080490471614 @masteroncrypto Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="jonkriptotwitter-15226">[https://twitter.com/Jon_Kripto/status/1819355941491384389 @Jon_Kripto Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="lauripeltotwitter-15227">[https://twitter.com/LauriPelto/status/1819088196380381251 @LauriPelto Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="paceking1twitter-15228">[https://twitter.com/paceking1/status/1819083344505942441 @paceking1 Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="0xkodawaritwitter-15229">[https://twitter.com/0xKodawari/status/1818208628614029387 @0xKodawari Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="akashbitcoinstwitter-15230">[https://twitter.com/akashbitcoins/status/1819091563097809099 @akashbitcoins Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="arizonyaatwitter-15231">[https://twitter.com/arizonyaa/status/1819079786377236684 @arizonyaa Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="islakwcterliitwitter-15232">[https://twitter.com/islakwcterlii/status/1819081895143264474 @islakwcterlii Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="cryptogurkhatwitter-15233">[https://twitter.com/crypto_gurkha/status/1819090978516750414 @crypto_gurkha Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="spreekawaytwitter-15234">[https://twitter.com/spreekaway/status/1819079751149273436 @spreekaway Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="miixcapitalcntwitter-15235">[https://twitter.com/MIIXCapital_CN/status/1819217477349601425 @MIIXCapital_CN Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="trendsgemtwitter-15236">[https://twitter.com/TrendsGem/status/1819352196947103974 @TrendsGem Twitter] (Accessed Sep 3, 2024)</ref>

<ref name="goplussecwarextwitter-15237">[https://twitter.com/GoPlusSecWareX/status/1819324996420096085 @GoPlusSecWareX Twitter] (Accessed Sep 3, 2024)</ref></references>

Starknet Discord Account Compromise Phishing - Revision history