Ariva Digital Key Breached

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Ariva Digital

Ariva Digital was a blockchain project with a focus on tourism and travel. One of their staking contracts was breached, presumably due to a private key breach. All assets were liquidated via TornadoCash. According to the team, they have enough funds to reimburse all affected users, although KYC will be required to get any funds. They are apparently working on fund recovery, although there is no indication that the perpetrators have been identified.

This is a global/international case not involving a specific country.

About Ariva Digital

"Ariva is a cryptocurrency launched by Ariva Co., produced for active use in global and local tourism and travel networks in the near future. Project is a worldwide B2C travel & tourism network where members can meet with global and local tourism service providers in the light of previous travelers' experiences and comments, make bookings with cryptocurrencies, and earn crypto money from both their reservations and valuable content sharing."

"With the arrival of ARIVA, the digital payment system is about to experience a massive innovative turnaround that can change the world and make trading easier and better. ARV came into existence with the intention to make transactions hassle-free in global and local tourism networks in the near future."

"The project aims at achieving active use in the tourism and travel industry, which is one of the largest and most important industries of the world economy, although none of the previously produced cryptocurrencies have been targeted. Out to be the game-changer in the cryptocurrency world, ARIVA’s aim is not only to produce a cryptocurrency trade on exchange but to ensure that ARV is actively used in the tourism industry."

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Ariva Digital Key Breached

Date	Event	Description
February 25th, 2022 2:21:00 AM MST	Twitter Announcement	Ariva Finance informs users that one of their staking wallets was hacked recently. The company's software security team has conducted investigations and identified the cause of the breach. They assure their users that Ariva has sufficient funding and resources to handle the situation. The Ariva Team guarantees that none of their investors will suffer any losses as a result of the hack. As a security measure, the Ariva Staking Factory will be temporarily inactive for a few days. The company emphasizes that during this process, any losses incurred by affected investors will be fully covered by the Ariva Team. They express gratitude for understanding and trust, highlighting that they consider their users to be part of a close-knit family. Ariva Finance requests that users rely only on official announcements for accurate information.

Total Amount Lost

The total amount lost has been estimated at $637,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Twitter Notice Posted By Ariva Digital

Dear Ariva Family, we regret to inform you that one of our staking wallets was hacked last night.  Our software security team has completed the necessary investigations and the cause of the leak has been determined.

Ariva has ample funding and power to handle this.  As Ariva Team, we undertake that none of our investors will be victims.  Ariva Staking Factory will not be active for a few days due to security measures.

During this process, the losses of our relevant investors will be covered by the Ariva Team. Thank you for your understanding and trust.  We are a big family!  Please only respect our official announcements.

"Blockchain security firm PeckShield revealed on February 25 that developers behind Ariva Digital ($ARV) have withdrawn the Token from the staking contract and swapped it to 1,700 WBNB."

"The @ArivaCoin's rugged funds 1,710 BNB (~$600k) have been deposited to @TornadoCash."

Ultimate Outcome

"Thanks to the meticulous work of our entire team and legal department and the exchanges that did not spare their support, we have reached some very important footprints of the perpetrators."

"We've already initiated the criminal procedure through our lawyers against the perpetrators and presented our complaints to the police and other governmental institutions."

"As a result of our investigation of the staking contract, we have detected more than one suspicious transaction, so we will not activate the ASF temporarily."

"For maximum security, all refunds will be made as a direct transfer following a KYC verification and wallet review." "[W]e're not going anywhere, we're just getting started."

Total Amount Recovered

The Ariva Finance team reports that they have enough funds to compensate all affected users, and that users will be compensated provided they are able and willing to complete a KYC procedure.

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

Individuals need to be cautious with all projects and ensure that projects are adequately audited. Ideally, projects should have most funds secured in a multi-signature wallet which has been validated by an external expert.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The situation could have been avoided with increased smart contract auditing, and losses could be majorly reduced if most funds were kept in a treasury wallet.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

Implementing a multi-signature wallet with keys held by human beings can reduce the risk by greatly simplifying the logic. Human beings are capable of critical thinking which software is generally not able to do.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

An industry insurance fund forms an alternative to having a platform keep aside a large treasury. It also helps to determine validators who can better ensure the protocol is secure.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

This situation could be prevented by a thorough validation process. A thorough validation process should include a check to ensure that there are multiple key holders, and that all key holders are able to act independently and aware of how to properly secure their key.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Exploits can be assisted via an industry insurance fund, which also helps select and assess validators.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.