BadgerDAO hackers stole $120 million in crypto with a simple but effective attack

On Wednesday night, someone drained funds from multiple cryptocurrency wallets connected to the decentralized finance platform BadgerDAO. According to the blockchain security and data analytics Peckshield, which is working with Badger to investigate the heist, the various tokens stolen in the attack are worth about $120 million.

While the investigation is still ongoing, members of the Badger team have told users that they believe the issue came from someone inserting a malicious script in the UI of their website. For any users who interacted with the site when the script was active, it would intercept Web3 transactions and insert a request to transfer the victim’s tokens to the attacker’s chosen address.

Because of the transparent nature of the transactions, we can see what happened once the attackers pounced. PeckShield points out one transfer that yanked 896 Bitcoin into the attacker’s coffers, worth more than $50 million. According to the team, the malicious code appeared as early as November 10th, as the attackers ran it at seemingly random intervals to avoid detection.

Decentralized finance (or DeFi) systems rely on blockchain technology to let crypto owners perform more typical finance operations like earning interest via lending. BadgerDAO promises users they can “rest easy knowing you never have to give up the private keys for your crypto, you can withdraw anytime you like, and our strategists are working day and night to put your assets to work.” Its protocol allows people who have Bitcoin to “bridge” their cryptocurrency over to the Ethereum platform via its token and take advantage of DeFi opportunities they otherwise might not have access to.

Once Badger became aware of the unauthorized transfers, it paused all smart contracts, essentially freezing its platform, and advised users to decline all transactions to the attacker’s addresses.

Thursday night, the company said it has “retained data forensics experts Chainalysis to explore the full scale of the incident & authorities in both the US & Canada have been informed & Badger is cooperating fully with external investigations as well as proceeding with its own.”

One of the things Badger is investigating is how the attacker apparently accessed Cloudflare via an API key that should’ve been protected by two-factor authentication. While the attack didn’t reveal specific flaws within Blockchain tech itself, it managed to exploit the older “web 2.0” technology that most users need to use to perform transactions. Multi-factor authentication systems protect our accounts against many phishing schemes or bulk credential stuffing attacks. Still, experts have repeatedly warned about targeted phishing attacks that can bypass it, while toolkits to automate the process have been available for years. An FBI notice in 2019 (pdf) called out criminals’ growing capabilities to bypass MFA and suggested changes or training that could make such attacks harder to pull off.

Getting two-factor authentication right can be tricky even within typical financial applications — just ask PayPal. But incidents like this one, or the stolen-and-returned $600 million hijack that Poly Network suffered in August, or the $53 million heist that hit the first DAO ever in 2016, are hopefully enough to expand awareness of security beyond protocols and encryption.

One commenter within Badger’s Discord summed up the situation by saying, “All [the] blockchain / smart contract audits in the world, and people lose 120m to a Cloudflare API leak by a sloppy team where a dude passes a new approval to his contract in the site header – GG – we still have a long way to go.” A member of the team said, “I’m sure we will have some mitigation procedures proposed after this.”

What funds can be recovered and how those affected will be made whole is still unknown. But for anyone living in the world of crypto, blockchain, and Web3 apps, it may ultimately be on them to learn how approvals, signing, and transactions really work and keep an eye on them. Particularly when millions of dollars in holdings can disappear in an instant even while managed by “one of the most security minded teams in DeFi,” as Badger refers to itself.