Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/truflationtruftokenmalwareattack.php}} {{Unattributed Sources}} Truflation Logo/HomepageThe truflation project aims to aggregate data from around the world to create true feeds of data such as inflation, and has since expanded into a number of other metrics. The project has a TRUF token launched. On September 25th, 2024, a malware attack targeted the projec..."

2024-10-29T18:18:44Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/truflationtruftokenmalwareattack.php}} {{Unattributed Sources}} thumb|Truflation Logo/HomepageThe truflation project aims to aggregate data from around the world to create true feeds of data such as inflation, and has since expanded into a number of other metrics. The project has a TRUF token launched. On September 25th, 2024, a malware attack targeted the projec..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/truflationtruftokenmalwareattack.php}}
{{Unattributed Sources}}

[[File:Truflation.jpg|thumb|Truflation Logo/Homepage]]The truflation project aims to aggregate data from around the world to create true feeds of data such as inflation, and has since expanded into a number of other metrics. The project has a TRUF token launched. On September 25th, 2024, a malware attack targeted the project at stole $5m USD worth of tokens. The project attempted to negotiate with the attacker and offer a $500k bounty, however there was no response. The project has ultimately launched a new token and is running the community through a migration.<ref name="truflationtwitter-16558" /><ref name="truflationtwitter-16559" /><ref name="truflationtwitter-16560" /><ref name="itwitter-16561" /><ref name="truflationtwitter-16562" /><ref name="truflationtwitter-16563" /><ref name="truflationtwitter-16564" /><ref name="truflationtwitter-16565" /><ref name="truflationtwitter-16566" /><ref name="truflationtwitter-16567" /><ref name="truflationtwitter-16568" /><ref name="etherscan-16569" /><ref name="etherscan-16570" /><ref name="etherscan-16571" /><ref name="messagestwitter-16572" /><ref name="etherscan-16573" /><ref name="truflationtwitter-16574" /><ref name="truflationtwitter-16575" /><ref name="truflationtwitter-16576" /><ref name="truflationtwitter-16577" /><ref name="truflationtwitter-16578" /><ref name="truflationtwitter-16579" /><ref name="truflationtwitter-16580" /><ref name="truflationtwitter-16581" /><ref name="truflation-13618" />

== About Truflation ==
"Decentralized Infrastructure For Real World Asset Metrics"

"RWAs are about to bring massive sums of money on-chain. This shift not only promises to enhance liquidity within digital markets but also aims to bridge the gap between TradFi assets and DeFi technology, enabling a more inclusive and versatile financial landscape."

"Precise and up-to-date information ensures that digital representations of real-world assets are accurate, trustworthy, and capable of fostering confidence among investors."

"In an era where skepticism towards official data and statistics is growing, the demand for transparent, decentralized, and verifiable data sources is more pressing than ever."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Truflation TRUF Token Malware Attack
!Date
!Event
!Description
|-
|September 25th, 2024 2:46:00 PM MDT
|Announcement On Twitter
|The Truflation team posts an announcement on Twitter with details of the exploit.
|-
|September 26th, 2024 5:48:11 AM MDT
|Message To Hacker
|A message is sent to the hacker offering a $500k bounty for the return of the remaining funds.
|-
|October 1st, 2024 10:09:00 AM MDT
|What We Learned About Hack
|Back strong, focused on business again. Nobody will ask for any money until formal blog post. Fake accounts are trying to convince followers to pay money for token migrations.
|-
|October 28th, 2024 7:59:00 AM MDT
|TRUF Token Redistribution
|Truflation announces a redistribution of TRUF tokens to "safeguard the Truflation ecosystem after the recent hack".
|-
|October 29th, 2024 5:02:00 AM MDT
|Migration Portal Live
|The Truflation migration portal is now live.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $5,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
"According to on-chain sleuth ZachXBT, the project Truflation was hacked a few hours ago for $5M+ on multiple chains from the treasury multisig and personal wallets."

"On September 25th, 2024, the Truflation team detected some abnormal activity. An attacker launched an attack using malware.

We are currently monitoring the situation and are taking measures to protect funds while we are investigating and working with law enforcement. The Truflation team is actively working with leading industry partners to further clarify the incident and will continue to try to contact the attacker to recover the assets.

Staking is unavailable at this time and there is limited liquidity on DEXs. Should the hackers decide to negotiate please contact: security@truflation.com.

We will continue to keep you updated and we are offering a reward to any white hats offering assistance."

== Ultimate Outcome ==
"To safeguard the Truflation ecosystem after the recent hack, we’re redistributing TRUF tokens. Migration starts tomorrow, October 29, at 11 am UTC for whitelisted addresses only."

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="truflationtwitter-16558">[https://twitter.com/truflation/status/1839043719124889963 @truflation Twitter] (Accessed Oct 28, 2024)</ref>

<ref name="truflationtwitter-16559">[https://twitter.com/truflation/status/1851217965309673826 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16560">[https://twitter.com/truflation/status/1841148383551242641 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="itwitter-16561">[https://twitter.com/i/broadcasts/1ZkJzRWwoMeJv @i Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16562">[https://twitter.com/truflation/status/1840099215755882687 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16563">[https://twitter.com/truflation/status/1839713703417295233 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16564">[https://twitter.com/truflation/status/1839341536880050620 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16565">[https://twitter.com/truflation/status/1839340522865037709 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16566">[https://twitter.com/truflation/status/1839337802246537514 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16567">[https://twitter.com/truflation/status/1839336634447520250 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16568">[https://twitter.com/truflation/status/1839322642085724653 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="etherscan-16569">[https://etherscan.io/tx/0xe3c7263cada26c510f5015b7fe63ed672ff17e3fbef89c8fcd10bd342b2e7552 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Oct 29, 2024)</ref>

<ref name="etherscan-16570">[https://etherscan.io/address/0x2867c57ddef630d64bfedb70b70b4b6c6c4c9187 Address 0x2867c57ddef630d64bfedb70b70b4b6c6c4c9187 | Etherscan] (Accessed Oct 29, 2024)</ref>

<ref name="etherscan-16571">[https://etherscan.io/address/0x2122a76213b23daf633b850cb659750db0cac801 Fake_Phishing554189 | Address 0x2122a76213b23daf633b850cb659750db0cac801 | Etherscan] (Accessed Oct 29, 2024)</ref>

<ref name="messagestwitter-16572">[https://twitter.com/messages/3012852462-1179586211553280000 @messages Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="etherscan-16573">[https://etherscan.io/tx/0x5aae1ceafabcc2a415f6cf2c489f66fdb24c706a83c913d8ca62441437f45c28 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16574">[https://twitter.com/truflation/status/1839302903519130041 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16575">[https://twitter.com/truflation/status/1839274402887905379 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16576">[https://twitter.com/truflation/status/1839228874540068965 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16577">[https://twitter.com/truflation/status/1839185291275546776 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16578">[https://twitter.com/truflation/status/1839138329071333663 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16579">[https://twitter.com/truflation/status/1839091390522781875 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16580">[https://twitter.com/truflation/status/1839091797534061004 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflationtwitter-16581">[https://twitter.com/truflation/status/1850900234257514578 @truflation Twitter] (Accessed Oct 29, 2024)</ref>

<ref name="truflation-13618">[https://truflation.com/blog/truf-token-faq-powering-permissionless-access-to-financial-data TRUF Token FAQ: Powering Permissionless Access to Financial Data | Truflation] (Accessed May 7, 2024)</ref></references>

Truflation TRUF Token Malware Attack - Revision history