Investors and token holders are raising serious questions about Truebit’s security auditing and monitoring in the wake of the $26M crypto hack, as the five-year-old smart contract that was exploited was well out of date and had seemingly been tested by the attackers several times.
The Mixin theft is currently the largest to hit a crypto company in 2023 and the 10th largest of all time. Security researchers have noted that one of the addresses the stolen $200 million was exfiltrated to has been seen in a previous Lazarus attack.
DeFi projects suffered another blow last week. Finance pools were hit hard not just by a set of hacks, but also a meme coin rug pull that drained substantial amounts of liquidity.
Binance suffered a crypto hack that led to a loss of $566 million. Attackers exploited a vulnerability in the Binance Smart Chain Token Hub bridge that involved using prior legitimate proof messages to forge new ones.
Cross-chain bridges have already lost over $1 billion to crypto hacks in 2022. The attack on Nomad may well have set the new record had there been more money on hand to steal.
Blockchain bridges, and DeFi in general, struggle with the lack of the kind of “security first” perspective that is necessary in the modern threat landscape. The Horizon crypto hack joins the likes of the breaches of Axie Infinity and Wormhole.