OpSec Staking Security Private Key Breach
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
The OpSec Ecosystem is a privacy-focused network dedicated to making operations on the cloud very seamless and efficient. Their staking contract was breached due to a private key which was leaked. A few hours later, a Twitter post was made requesting users to migrate to a V2 version of the contract by sending their V1 tokens to a new address. Despite having comments disabled and coming at the time of the breach, this post was apparently from the legitimate OpSec team. Those users who did not transfer their tokens within the 2 week period appear to have lost their funds, however they may be reimbursed on a case by case basis.[1][2][3][4][5][6][7][8][9][10][11]
About the OpSec EcoSystem
"OpSec Ecosystem is a privacy-focused network dedicated to making operations on the cloud very seamless and efficient."
"OpSec decentralized cloud solutions range from high level nodes, light speed router devices, GPUs and hosting services."
"OpSec's decentralized architecture is built upon advanced cloud network technology and it forms the foundation of a secure and resilient computing environment.
OpSec Nodes, the backbone of this infrastructure, allow users to deploy projects autonomously or collaboratively, fostering a diverse and inclusive ecosystem.
OpSec's decentralized computing architecture is meticulously crafted to redefine the landscape of distributed systems. Whether you are hosting decentralized apps, deploying blockchain nodes, or remotely accessing your servers, OpSec makes sure that your journey is characterized by security, independence, and innovative forward-thinking."
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
"The OpSec staking contract was maliciously upgraded, allowing the attacker to withdraw and sell OPSEC tokens worth approximately 59 ETH (around $182,000)."
| Date | Event | Description |
|---|---|---|
| July 10th, 2024 7:13:47 AM MDT | Malicious Blockchain Transaction | The malicious transaction on Ethereum which is reportedly due to a breached private key, allowing the attacker to change the ownership of the staking contract to a wallet that they control. |
| July 10th, 2024 10:25:00 AM MDT | OpSec Announcement Tweet | The OpSec Twitter account posts an update to let followers know that an hour ago, external attackers breached the security of the $OPSEC staking contract and stole some funds. The team is quickly working to address the issue by withdrawing liquidity and migrating to a new contract address. They are requesting $OPSEC holders to send their tokens to a recovery address to receive updated V2 tokens. Funds are safe, and the marketing and development wallets are secure and being migrated to new wallets. Post-migration improvements include better security, no contract dumps, lower tax rates, and higher liquidity. Users who held $OPSEC tokens before July 10, 2024, 15:15 UTC are safe. The team will provide more details soon and is currently holding an AMA on Telegram. The message is authentic, and the team warns to be cautious of scams. |
| July 21st, 2024 12:12:00 PM MDT | Continual Work On Relaunch | The team posts continual updates to Twitter about the relaunch of their new v2 token. The new $OPSEC V2 contract will be audited by Hacken starting Wednesday, with completion expected by Friday. This will be followed by the relaunch. The V2 contract will have 0% buy and sell tax, increased liquidity, and improved security. For DEX users, send your V1 tokens to the V2 recovery address by July 26, 2024. CEX users should wait for further instructions as the transition will be managed by exchanges. V2 tokens will be distributed through a claim-based method to reduce gas fees, minimize risks, and manage trading pressure. An eligibility form will be available on CloudVerse. |
Technical Details
"A private key with access to make changes to the staking contract was compromised. This allowed the attacker to change the ownership of the staking contract from a team wallet to the attackers wallet."
Total Amount Lost
"At the time of the Breach the compromised tokens had a value of approximately $800,000.
At the time that the attacker was able to trade these tokens for Ethereum from the liquidity pool, he was only able to do so for an approximate value of 59 Ethereum."
The total amount at risk has been estimated at $800,000 USD. The total amount lost has been estimated at $182,000 USD.
Immediate Reactions
"An hour ago, we experienced a security breach by external attackers, resulting in the theft of some funds from our staking contract.
We are taking immediate measures to address the situation by withdrawing liquidity from the current $OPSEC contract. We need to act fast to recover and migrate the contract address (CA).
To support this urgent migration, we need your help. Please send your $OPSEC tokens to the recovery address below to receive V2 tokens during the migration.
$OPSEC Recovery Address: 0x362538c16a2868038AE72B608c080B6433f979C9
Snapshot of current holders of V2 airdrop was taken. Please do not buy current $OPSEC token.
Key Points:
Funds are safe: You can relax and follow the instructions provided above. Marketing and development wallets are secure: We are migrating them to isolated fresh wallets.
Post-migration benefits include:
- Increased contract security - No contract dumps - Lower tax rates - Higher liquidity
User Safety: All users are safe. If you are an $OPSEC holder who did not purchase after 15:15 UTC, Wednesday, 10 July 2024, you are completely safe. We will handle individual cases as needed.
Upcoming Updates:
More details will be shared ASAP regarding the root cause of the breach.
An AMA is live NOW on telegram addressing the situation.
Rest assured, this message is from the internal OpSec team. Our Twitter account has not been hacked."
Ultimate Outcome
"Our team is diligently compiling a comprehensive overview of token distribution and transactions during and after the breach. This involves developing a script and processing extensive data for a thorough understanding beyond a simple snapshot. Once all data is gathered and analyzed, it will be transparently shared with the community. We have completed the stakers' data and vestments, and the CEXs typeform is progressing well. We will crosscheck addresses promptly to be ready for launch."
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ SlowMist Hacked - SlowMist Zone (Accessed Aug 27, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ OpSec (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)
- ↑ @OpSecCloud Twitter (Accessed Aug 28, 2024)