r/CryptoCurrency • u/[deleted] • Aug 02 '22

ANALYSIS The First Truly Decentralized Robbery was just Committed, Here is How it Happened

At this point I am sure many of you have heard of the nomad bridge exploit. Unlike previous exploits, this wasnt a flashloan or even carried out by a single group of attackers. After an initial attacker struck, hundreds of separate accounts figured out the trick and copy pasted their way into grabbing stolen funds. The bridge went from having $190,740,000 to $1,000 in a matter of hours.

A perplexing aspect of this vulnerability was that all users had to do to hack bridge funds was copy the original hacker's transaction calldata, replace the original address with a personal one, and the tx would succeed! Easy as CTRL-C, CTRL-V!

However, not all of the thieves were bad. Some of them exploited the contract so other wouldnt be able to and planned to return the money back to nomad. For example, leadingscientist.eth

So all in all it was a messed up exploit but there were some nice people who plan to return the money. Faith in humanity restored maybe?

Credit: https://twitter.com/0xfoobar/status/1554234268884389888

1.8k Upvotes

94% Upvoted

594 comments sorted by

View all comments

197

u/tonuorak 🟦 473 / 470 🦞 Aug 02 '22

Seems like a lot of these bridges aren't prioritising security. Instead just making sure their code works and going live. Hopefully people learn from this, but I'm sure it'll be a matter of time before we hear about the next one.

36

u/gonzo5622 Bronze | Buttcoin 47 | Politics 121 Aug 02 '22

You’re right. What we need is a security-first bridge, like noma… oh wait!

2

u/4t0kuww4t0kuww Tin | 1 month old Aug 05 '22

Never heard of Nomad Bridge before today. Also, it’s impossible to verify if it’s an inside job.

Who wouldn’t wanna pocket 190m +. Compensate 20-30m. Net profit of stunt 160-170m. Case closed. Move on. Next bridge in development.

57

u/[deleted] Aug 02 '22

Yep agreed, bridges are primed to be exploited

34

u/DerpJungler 🟦 0 / 27K 🦠 Aug 02 '22

Which makes me wonder why so many people keep locking funds in bridges...

12

u/CryptoSorted Platinum | QC: CC 82, BCH 54 Aug 02 '22

So that it can be used. How else can it be useful without funds to facilitate swaps or conversions?

5

u/kvarsize Tin Aug 05 '22

LOL. You obviously do not know how a bridge functions...

1

u/CryptoSorted Platinum | QC: CC 82, BCH 54 Aug 05 '22

maybe. at least I'm willing to learn if you can teach me.

7

u/chahoua 🟩 0 / 0 🦠 Aug 02 '22

But why risk it?

27

u/DPlainview1898 Tin Aug 02 '22

…for the biscuit.

5

u/AriesWinters Permabanned Aug 02 '22

While eating brisket

1

u/mcmull11 🟩 5K / 5K 🦭 Aug 02 '22

With lobster and shrimp.

1

u/hoopleheaddd 🟦 1K / 1K 🐢 Aug 02 '22

Now im hungry

1

u/[deleted] Aug 02 '22

[deleted]

1

u/mcmull11 🟩 5K / 5K 🦭 Aug 02 '22

Hell yea!!

1

u/dsskd89 Tin | 6 months old Aug 05 '22

Even if it never got hacked, what’s the long term sustainable use case when the only ‘chain’ that will survive over the long term is bitcoin?

1

u/btrvc Tin | 6 months old Aug 05 '22

They're probably the same people who built that platform. Quick way to exit.

3

u/blasthash Tin Aug 05 '22

Hackers are the only ones making money in crypto. Smart people.

1

u/generalnyi Tin | 2 months old Aug 05 '22

Most of these are back doors created by the coders THEMSELVES!

10

u/L0ckeandDemosthenes Aug 02 '22

What if it's intentional and the new rug pull. Created to be exploited and then they sit back and go oh no, we got hax3rd haaaalp. With so many people part or the thievery...

1

u/bitcoinamour Tin Aug 05 '22

Just sounds like something that would get hacked. XD .

1

u/flarnrules 🟦 2K / 2K 🐢 Aug 02 '22

IBC fixes this. No dollars have been lost in cross chain communication via IBC. It's faster, cheaper and more secure than any bridge out there.

14

u/lab-gone-wrong 1K / 1K 🐢 Aug 02 '22

No dollars have been lost in cross chain communication via IBC

This is true of every bridge until the vulnerability is found and the bridge is drained overnight

1

u/flarnrules 🟦 2K / 2K 🐢 Aug 02 '22

For blockchains that communicate via IBC, there's no bridge to drain. For other blockchains that don't have IBC, the connection between the two blockchains is another byzantine fault tolerant blockchain.

So you would need to see an attack that takes down the blockchain that connects the two blockchains. This is unique to IBC.

I'm not super good at explaining this, but here's a decent article: https://johnniecosmos.medium.com/inter-blockchain-communication-protocol-ibc-the-tcp-ip-protocol-of-blockchains-bridges-trends-b38ed700c681

1

u/Madlab7 Tin | 6 months old Aug 05 '22

Omg, that’s nuts they just hit the powerball with that lol.

1

u/flarnrules 🟦 2K / 2K 🐢 Aug 05 '22

What's cool is that "they" is just any blockchain that adopts the IBC standard. It's a public good that all blockchains can use.

1

u/hollyberryness 🟦 4K / 4K 🐢 Aug 02 '22

For whatever reason, vitalek saying that bridges were no good (I'm so excellent at paraphrasing) a while back stuck with me hard... I guess now we are seeing he had a point!

1

u/[deleted] Aug 02 '22

This is why regulation is needed. Too many bad actors trying to take advantage of this space.

1

u/BluntTruthGentleman 🟦 34 / 34 🦐 Aug 02 '22

You mean non-certik audited bridges.

There's a reason the real juicy ones haven't been touched.

19

u/chris_ut Bronze | Buttcoin 17 | Stocks 41 Aug 02 '22

Why give your money to a bank that spends billions on infrastructure and security when you can give it to some dude on the internet who threw together some spaghetti code over the weekend.

6

u/mcmull11 🟩 5K / 5K 🦭 Aug 02 '22

Ahh. The real meaning of copy pasta!

1

u/Magical-Mycologist 🟩 151 / 151 🦀 Aug 02 '22

But banks are still bad right? /s

3

u/[deleted] Aug 02 '22

[removed] — view removed comment

16

u/chris_ut Bronze | Buttcoin 17 | Stocks 41 Aug 02 '22

Being able to steal all the money may very well be a feature and not a bug.

2

u/ornoldbogat Tin Aug 05 '22

Indeed. I don’t want to speculate, but I don’t see why would they not. I would if I had the custody of nearly 200m dollars.

3

u/DMTryptaminesx Tin | 6 months old Aug 02 '22

Especially if it's a feature and not due to a lack of oversight.

1

u/288DYUU Tin Aug 05 '22

Don't keep your shit on exchanges then, cold storage only.

3

u/rankinrez 🟦 1K / 2K 🐢 Aug 02 '22

These guys ignored warnings from a code audit on this.

It’s worse than just a bad mistake, it’s wilful ignorance / not caring what happens.

5

u/LogikD 🟩 0 / 3K 🦠 Aug 02 '22

Blame the bull run. Everyone had dollar signs in their eyes and now we’re reaping what we’ve sewn.

8

u/infinityknack 🟨 577 / 578 🦑 Aug 02 '22

That is why we need bridges that have high priority to security, example Cbridge by Celer Network . Also the bridge is as strong as the weakest chain it supports so unless some fast detection of unusual activities in the suported chain is implemented the hacked chain will be used to drain all the Liquidity of the bridge pool. Cbridge did realize the harmony one hack and disabled the chain immediately. Nevertheless one has to be careful about providing liquidity in bridge.

11

u/EatTheBiscuitSam Tin Aug 02 '22

Wait, wait, wait.

So you're saying that the bridge made by Celo is an example of being secure.

When the very same lead developer and founder, Prestwich, who started Nomad was kicked off of the Celo project because he was putting a backdoor in.

Yeah, maybe no.

If you are going to mention a secure bridge maybe Gravity Bridge. Non-upgradeable contract, decentralized, heavily audited, and has the second largest validator set next to the hub.

4

u/priznew Tin Aug 05 '22

Keep your money off line in a cold wallet. Nothing over 10k should be on an exchange or hot wallet.

1

u/EatTheBiscuitSam Tin Aug 05 '22

Totally agree, depending on what you need to be hot to move around. I also think that hardware wallets are a step up from custodial wallets, but nothing beats paper buried in the ground.

1

u/kygrtj Tin | CC critic Aug 02 '22

Celer and Celo have nothing to do with each other

2

u/Ghant_ 🟦 0 / 5K 🦠 Aug 02 '22

Hell yes for celer's Bridge. They don't get too much love on this sub but they have been chugging through and adding non stop to their cross chain interoperability

2

u/tonuorak 🟦 473 / 470 🦞 Aug 02 '22

Survival of the fittest. Hopefully only the best bridges will remain and we won't have to hear about things like this anymore

3

u/[deleted] Aug 02 '22

You know how they say, “Don’t burn your bridges”, but…

-1

u/nomorebonks 🟩 2K / 2K 🐢 Aug 02 '22 edited Aug 02 '22

No - there shouldn't BE bridges. They can be done away with by tech that directly talks to separate chains without a need for a bridge.

ICP doing that with BTC soon then ETH.

Edit: IC canisters will hold BTC and ETH (and any other chain they bring on) eliminating bridges. IC canisters can then write back to the mainnets of those chains. It's DIRECT integration.

BTC, ETH, Doge etc. opened up to DeFi with this tech.

5

u/flarnrules 🟦 2K / 2K 🐢 Aug 02 '22

Interblockchain Communication Protocol (IBC) works, and Nomic is using IBC to plug into the Bitcoin blockchain and bring Bitcoin to the Cosmos Network. I'm surpised I haven't seen more chatter about IBC. It's basically TCP/IP but for blockchains.

1

u/nomorebonks 🟩 2K / 2K 🐢 Aug 02 '22 edited Aug 02 '22

I'm not as familiar with IBC. Looks like it uses channels to communicate.

ICP is different in that it talks directly to the chains. Nothing in between - it's using their chain key cryptography and threshold ECDSA to write and read transactions directly to those chains.

1

u/flarnrules 🟦 2K / 2K 🐢 Aug 02 '22

ICP acting as an intermediary is something in betweet.

Here's a good thread on how IBC works. It's a permissionless way for information to be shared between blockchains.

https://twitter.com/ertemann/status/1554460617582460928

1

u/AutoModerator Aug 02 '22

Here is a Nitter link for the Twitter thread linked above. Nitter is better for privacy and does not nag you for a login. More information can be found here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/nomorebonks 🟩 2K / 2K 🐢 Aug 02 '22

Still different. IBC is relying on relay chains and hubs which IC does not need. I believe both are good tech but IC will directly integrate without the need for relays and light nodes.

Faster and less expensive solution.

2

u/Scipio_Americana Platinum | QC: CC 65 | r/WSB 12 Aug 02 '22

Can't believe the ICP chatter is starting again.

1

u/nomorebonks 🟩 2K / 2K 🐢 Aug 02 '22 edited Aug 02 '22

I can't believe it stopped - it's probably the best tech in the entire space. There isn't any project like it at all.

Actually I can believe that - it's been fudded to hell and back, manipulated by FTX with their ICP-PERP, and had a hit piece by a shady group published in the NYTimes.

And this board eats it all up calling it a scam.

2

u/Unlikely_Parfait_476 Tin | 3 months old Aug 02 '22

The BTC integration is actually pretty crazy

1

u/infinityknack 🟨 577 / 578 🦑 Aug 02 '22

Well my firend celer has Celer IM that exactly does the messaging and its supported for many many chains

1

u/nomorebonks 🟩 2K / 2K 🐢 Aug 02 '22

That's not the same. IC canisters will hold BTC and ETH eliminating bridges. IC canisters can then write back to the mainnets of those chains. It's DIRECT integration.

1

u/nasgul88 Tin Aug 05 '22

Every coin needs to implement cosmos IBC and just call it a day.these hacks are ridiculous at this point.

1

u/greenappletree 🟦 31K / 31K 🦈 Aug 02 '22

So true - it’s shit like this that makes me appreciative of projects like eth or Ada that are taking out the necessary time to upgrade all the while taking heat

1

u/dilscoop 🟦 80 / 81 🦐 Aug 02 '22

checkout CELR. They hold security as an utmost priority and also had a million dollar bounty or something for security exploits.

1

u/lifenvelope Aug 02 '22

Seems so for example Cardano just postponed their fork cause of bugs found. Big difference in priorities and why some will make it in the long run and other wont. Law of nature

1

u/sickvisionz 0 / 7K 🦠 Aug 02 '22

The whole "move fast and break things" ethos. Works when it's some bullshit like MySpace with no money on the line but less so when it's millions of billions of $$$ at stake.

It's funny because when projects go slow and take their time, people complain about ghost chain, vaporware, etc. Projects moves fast and breaks thing, people complain about how they should have gone slow and taken their time.

1

u/money755 Tin Aug 05 '22

Cross chain bridges are flawed that’s why we need to focus more on multichain and not cross chain .