AllBridge Malicious DNS Hijack

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Jump to navigation Jump to search

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

AllBridge

About AllBridge

Allbridge, founded in 2021, is a "[c]ross-chain solutions provider" which offers "[t]he most convenient cross-chain transfers"[1][2]. The service offers AllBridge Classic, Allbridge BaaS, and Allbridge Core[1].

"Allbridge is a simple, modern, and reliable way to transfer assets between different networks. It is a bridge between both EVM (Like Ethereum, Polygon, BSC) and non-EVM compatible (like Solana, Terra) blockchains, that aims to cover L2 (like Arbitrum, Optimism) solutions and NFT transfers in the future. Allbridge’s mission is to make the blockchain world borderless and provide a tool to freely move assets between different networks."

"Allbridge Classic is a generalized bridge between EVM and non-EVM compatible blockchains, supporting native and wrapped token transfers."

"Allbridge BaaS is a white-label bridging solution that supports Solana, NEAR, Tron, and all EVM chains. The product offers a simple, customizable UI, a flexible architecture setup, full ownership of smart contracts, and a validator."

"Allbridge Core enables the transfer of value between blockchains by offering cross-chain swaps of native stablecoins. Being messaging protocol agnostic, Allbridge Core connects a variety of EVM and non-EVM networks."

The AllBridge smart contracts have been audited by Hacken and was undergoing an audit by Kudelski Security[3][4][5][6][7]. AllBridge provides a list of all smart contract addresses on their website[8][9].

The Reality

While the smart contract operates in a decentralized manner, most users will tend to interact with the contracts using transactions generated by a centralized website. When a domain name is accessed on the internet, a service called DNS is used to point the domain name to an IP address[10].

The AllBridge project used NameCheap for their registrar for their primary website[11]. The procedures at NameCheap were such that support team members were able to override the DNS of the website to point the domain name to a malicious server[12][13][14].

What Happened

The account of a customer support agent for NameCheap was hacked[15].

This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including Convex Finance, Ribbon Finance, Defi Saver, and AllBridge[16]. The attacker was able to override any 2-factor authentication, passwords, and security alert settings[17][18][19].

Key Event Timeline - AllBridge Malicious DNS Hijack
Date Event Description
March 22nd, 2022 Domain Vault Announced The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon"[20].
June 20th, 2022 3:05:42 AM First Malicious Contract The very first smart contract is created by a wallet controlled from the attacker[21].
June 20th, 2022 9:01:35 AM First Spoof Contract of AllBridge The very first smart contract (0xbbbd2ed360dac9f6e005fc6a4398d7d6beabe884) is created[22] that spoofs AllBridge's bridge contract (0xBBbD1BbB4f9b936C3604906D7592A644071dE884)[23]. There is no evidence that anyone interacted with this contract[24].
June 20th, 2022 Domain Vault Launches The NameCheap "Domain Vault" service now switches from "Get early access" to "Get Domain Vault" with the price remaining at $19.88/mo[25][26].
June 21st, 2022 7:35:00 AM AllBridge New Chapter AllBridge publishes their "AllBridge: The New Chapter" to their Medium[27] and shares a link on Twitter[28]. It is unknown whether the DNS breach had yet occurred when this was posted.
June 21st, 2022 7:13:11 PM Second Spoof Contract of AllBridge A second smart contract (0xbbbd89e4cd6c0ac07f164b84546b6439d415e884) is created[29] that spoofs AllBridge's bridge contract (0xBBbD1BbB4f9b936C3604906D7592A644071dE884)[23]. There is no evidence that anyone interacted with this contract[30].
June 22nd, 2022 8:29:00 AM AllBridge Unrelated Tweet An unrelated tweet to "[c]heck out the cool updates to @MercurialFi's Dynamic Yield Layer."[31] suggests that AllBridge still hadn't been breached yet or was unaware of any attack.
June 23rd, 2022 3:28:00 AM Final Spoof Contract of AllBridge A third smart contract (0xbbbd216c0334a9e4ce7d0acde5189b5548e3e884) is created[32] that spoofs AllBridge's bridge contract (0xBBbD1BbB4f9b936C3604906D7592A644071dE884)[23]. There is also no evidence that anyone interacted with this contract[33].
June 23rd, 2022 6:00:00 AM AllBridge Aware of Breach AllBridge reports becoming aware that "in some cases bridge was requesting a second spend approval on the EVM chains" at "12:00 UTC"[34] and that it was "successfully solved in an hour after it was discovered"[35].
June 23rd, 2022 6:17:41 AM Final Malicious Contract The final malicious smart contract is created by the attacker[36].
June 23rd, 2022 7:39:00 AM Revoke Approvals Tweet AllBridge posts a Twitter notice requesting visitors to "revoke approvals given via our interface in the last 5 hours"[37].
June 23rd, 2022 1:02:00 PM Alexintosh Convex Finance Tweet The Twitter user @alexintosh reported an abnormal approval requested by the similarly affected Convex Finance website, with a similar but not exact smart contract address[38][39][40].
June 23rd, 2022 2:23:00 PM Please Review Approvals Convex Finance posts their very first announcement on Twitter, requesting users to "[p]lease review approvals while we evaluate a potential front end issue[41]."
June 23rd, 2022 3:46:00 PM Additional Malicious Contracts Twitter user @HarukoTech describes several malicious contracts which were created against different protocols and that "[t]he attacker seems to be generating similar addresses to well know[n] protocols"[42].
June 23rd, 2022 3:54:00 PM Bret Woods Suggestion Twitter user Bret Woods (@fewture) posts that "[w]e're seeing hackers create addresses that match the first 4 and last 4 characters". His suggestion is to run the same transaction with "the gas SUPER LOW. Like 5 gwei. Your transaction won't go through, but it will populate on @etherscan where it is much easier to click through and make sure it's doing what you intended to do"[43].
June 23rd, 2023 4:33:00 PM AllBridge Interface Notice AllBridge provides a new tweet requesting affected users to "revoke the approval they did for the bridge throughout the past week" and announces they've updated their interface with a revoke notice specifically targeting affected wallets[44].
June 23rd, 2022 4:46:00 PM Convex Finance DNS Hijack Post Similarly affected Convex Finance first posts on Twitter to announce the DNS hijacking. They list 5 addresses which are affected, that investigation is still ongoing, and that the issue is "remediated" for their service[45][46].
June 24th, 2022 5:58:00 AM Interest In Joining Forces Andriy responds to Convex Finance's tweet, reporting that the AllBridge protocol suffered the same attack, and enquiring about joining forces to find the responsible party[47].
June 24th, 2022 6:02 :00 AM Telegram Group Joined Andriy sends a DM to join a Telegram group with other affected protocols[48][49].
June 24th, 2022 6:07:00 AM Twitter Investigation Results AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".[35] They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"[50].
June 24th, 2022 6:14:00 AM MDT All Attacks Reported Together All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA[19].
June 24th, 2022 7:00:00 AM MDT Attacks Reported With Screenshots Twitter user Nalin Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread[51].
June 24th, 2022 7:24:00 AM MDT Speculation About Further Domains Further speculation arises that some other domains may be related[52]. The list referenced are cryptocurrency phishing websites and it does not appear that any of those domains are related to the DNS attack[53].
June 24th, 2022 7:29:00 AM Attacks Reported Together Again Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread[54].
June 24th, 2022 10:01:00 AM NameCheap Response NameCheap's CEO responds on Twitter that they've "traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."[55]
June 24th, 2022 10:03:00 AM Free DomainVault Monitoring NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"[56].
June 24th, 2022 10:32:00 AM MDT Nothing To Worry About NameCheap assures via Twitter that "[t]here is nothing to worry about" and they will "keep investigating"[57].
June 24th, 2022 11:21:00 AM NameCheap DomainVault "Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand [DNS]. If you want complete security use [DomainVault]"[58]
June 24th, 2022 4:16:00 PM NameCheap Clarifies Hack NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."[15]
June 25th, 2022 Domain Vault Discount NameCheap lowers the price of their Domain Vault service from $19.88/mo[59] to $1.88/mo[60].
June 26th, 2022 5:24:00 AM Tuvaru_Crypto Affected Twitter user @Tuvaru_Crypto responds that they "use[d AllBridge the] other day and have been away all weekend and now found [their] wallet drained[61]".
June 26th, 2022 5:59:00 AM AllBridge Response To Tuvaru_Crypto AllBridge responds to request further information from Tuvaru_Crypto[62].
July 2nd, 2022 Price Segmentation NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo[63] to "Titanium" tier at $19.88/mo[64].
July 8th, 2022 Kudelski Security Audit AllBridge reports that an audit by Kudelski Security has been successfully completed. No mention of the DNS exploit is made in this post[7].

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

A Telegram group was set up for communication between the different affected protocols[49].

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

It does not appear that any details about the incident were posted on their Medium page[7].

Ultimate Outcome

The NameCheap CEO ultimately responded on Twitter to explain that there was a hacked or compromised customer support agent and all access was removed from them[55]. He also offered completely free Domain Vault monitoring to all affected services[65].

"We've traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating." "In the meantime we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring."

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

AllBridge posted the completion of an additional audit by Kudelski Security to their Medium on July 8th, roughly a week after the attack. While this may suggest an increased focus on security, the audit would obviously be unrelated to the website front-end or DNS services[7].

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

There are two policies which apply in this case. See the Prevention Policies for Individuals page for the full list.

Full Prevention

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

Limiting Losses

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

Platform Prevention Policies

There are three different policies applying here. See the Prevention Policies for Platforms page for all policies.

Prevention by Namecheap

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

The issue ultimately stemmed from a single customer support agent being compromised. A multi-signature requirement on DNS changes would have prevented this scenario entirely. While NameCheap offers advanced protections on their domain names, this service had just launched two days prior to the DNS change, so it was unlikely to be a reasonable expectation that Convex Finance would have already signed up.

Prevention by AllBridge

All points along the communication and supply chain should be inspected for vulnerabilities. Common vulnerability points may include DNS, Discord, and customer information. What steps are required to access and/or modify the component? Do any third party companies or organizations implement a proper multi-signature approach? What additional security options are available?

Regulatory Prevention Policies

There is one policy to prevent the situation, and one to reduce the impact. See the Prevention Policies for Regulators page for the full list of policies.

Full Prevention Through Security Assessments

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Reduction Through Education

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

This could greatly reduce the effectiveness of a similar fraud to affect those such educated.

References

  1. ↑ 1.0 1.1 Allbridge is the best cross-chain bridging solution provider. (Feb 7, 2023)
  2. ↑ What is Allbridge? - Allbridge (Feb 7, 2023)
  3. ↑ AllBridge Security Overview - AllBridge Docs (Feb 25, 2023)
  4. ↑ AllBridge Audit Performed by Hacken (Feb 25, 2023)
  5. ↑ AllBridge Audit by Kudelski Security (Feb 25, 2023)
  6. ↑ Allbridge Successfully Completes Smart Contract Code Review By Hacken - AllBridge Medium (Feb 25, 2023)
  7. ↑ 7.0 7.1 7.2 7.3 Kudelski Security Audit Completed - AllBridge Medium (Feb 25, 2023)
  8. ↑ Bridge Contract Addresses - AllBridge Docs (Feb 25, 2023)
  9. ↑ Bridge Contract Addresses on May 27th, 2022 - AllBridge Docs Archived (Feb 25, 2023)
  10. ↑ What is DNS? | How DNS works | Cloudflare (Feb 9, 2023)
  11. ↑ Post Mortem Of Events June 23 (Aug 24, 2022)
  12. ↑ @ConvexFinance Twitter (Aug 24, 2022)
  13. ↑ @DevanCollins3 Twitter (Aug 24, 2022)
  14. ↑ @LefterisJP Twitter (Feb 10, 2023)
  15. ↑ 15.0 15.1 @NamecheapCEO Twitter (Feb 11, 2023)
  16. ↑ DeFi Dapps DNS Attacked - TrustNodes (Feb 25, 2024)
  17. ↑ DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter (Mar 23, 2023)
  18. ↑ DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter (Mar 23, 2023)
  19. ↑ 19.0 19.1 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter (Apr 1, 2023)
  20. ↑ Domain Vault Page on Mar 22nd, 2022 - Namecheap (Feb 9, 2023)
  21. ↑ First Smart Contract Creation - EtherScan (Feb 23, 2023)
  22. ↑ First AllBridge Spoof Contract - Etherscan (Feb 25, 2023)
  23. ↑ 23.0 23.1 23.2 AllBridge's Bridge Contract - Etherscan (Feb 25, 2023)
  24. ↑ No Interaction With First Spoof Contract - Etherscan (Feb 25, 2023)
  25. ↑ Domain Vault Page on June 19th, 2022 - Namecheap (Feb 12, 2023)
  26. ↑ Domain Vault Page on June 20th, 2022 - Namecheap (Feb 12, 2023)
  27. ↑ AllBridge: The New Chapter - AllBridge Medium (Feb 25, 2023)
  28. ↑ @Allbridge_io - "share our vision of the new generation of #crosschain transfers" - Twitter (Feb 25, 2023)
  29. ↑ Second Spoof Smart Contract Created - Etherscan (Feb 25, 2023)
  30. ↑ No Interaction with Second Spoof - Etherscan (Feb 25, 2023)
  31. ↑ @Allbridge_io - "Check out the cool updates to @MercurialFi's Dynamic Yield Layer." - Twitter (Feb 25, 2023)
  32. ↑ Final Spoof Contract Creation - Etherscan (Feb 25, 2023)
  33. ↑ No Interactions With Final Spoof - Etherscan (Feb 25, 2023)
  34. ↑ @Allbridge_io - "in some cases bridge was requesting a second spend approval on the EVM chains" - Twitter (Feb 25, 2023)
  35. ↑ 35.0 35.1 @Allbridge_io - "we would like to disclose the results of our investigation" - Twitter (Feb 25, 2023)
  36. ↑ Final Malicious Contract Creation - EtherScan (Feb 23, 2023)
  37. ↑ @Allbridge_io - "revoke approvals given via our interface in the last 5 hours" - Twitter (Feb 25, 2023)
  38. ↑ @Alexintosh Twitter (Aug 23, 2022)
  39. ↑ Contract Addresses - ConvexFinance (Aug 24, 2022)
  40. ↑ https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)
  41. ↑ @ConvexFinance - "Please review approvals while we evaluate a potential front end issue." - Twitter (Aug 23, 2022)
  42. ↑ @HarukoTech Twitter (Aug 24, 2022)
  43. ↑ Bret Woods (@fewture) Guide - Twitter (Feb 22, 2023)
  44. ↑ @Allbridge_io - "revoke the approval [you] did for the bridge throughout the past week" - Twitter (Feb 25, 2023)
  45. ↑ @ConvexFinance Twitter (Aug 24, 2022)
  46. ↑ https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)
  47. ↑ Andriy @avelykyy - "would be happy to to align efforts in finding the responsible party" - Twitter (Feb 27, 2023)
  48. ↑ Andriy @avelykyy - "DMd" - Twitter (Feb 27, 2023)
  49. ↑ 49.0 49.1 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter (Feb 27, 2023)
  50. ↑ @Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter (Feb 25, 2023)
  51. ↑ Nalin Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter (Apr 1, 2023)
  52. ↑ Nalin Gupta - "It does seem some others might be affected tho[ugh]" - Twitter (Apr 1, 2023)
  53. ↑ idclickthat - "crypto phish" - Twitter (Apr 1, 2023)
  54. ↑ TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter (Mar 24, 2023)
  55. ↑ 55.0 55.1 @NamecheapCEO - "traced this down to a specific [customer support] agent that was either hacked or compromised" - Twitter (Aug 24, 2022)
  56. ↑ @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter (Feb 24, 2023)
  57. ↑ NameCheap - "There is nothing to worry about; we keep investigating" - Twitter (Apr 1, 2023)
  58. ↑ @NamecheapCEO "If you want complete security use [Domain Vault]" - Twitter (Aug 24, 2022)
  59. ↑ Domain Vault Page on June 24th, 2022 - Namecheap (Feb 13, 2023)
  60. ↑ Domain Vault Page on June 25th, 2022 - Namecheap (Feb 13, 2023)
  61. ↑ @Tuvari_Crypto - "I use this site other day and have been away all weekend and now found my wallet drained" - Twitter (Feb 25, 2023)
  62. ↑ @Allbridge_io - "send an email ... with a detailed description of this issue" - Twitter (Feb 25, 2023)
  63. ↑ Domain Vault Page on July 1st, 2022 - Namecheap (Feb 13, 2023)
  64. ↑ Domain Vault Page on July 2nd, 2022 - Namecheap (Feb 13, 2023)
  65. ↑ @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter (Feb 24, 2023)
Retrieved from "https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=AllBridge_Malicious_DNS_Hijack&oldid=3218"