For DApp developers, fund security is a dimension that must be given special consideration.
Author: @Web3Mario
Abstract: There were a lot of big things last week. The Federal Reserve cut interest rates by 50 BP relatively aggressively, and the Bank of Japan stayed on hold. This basically indicates that at least there will be no excessively negative information in the next few weeks. There are already related analysis articles There are quite a few, so I won’t go into details here. In this process, as long as everyone pays attention to two logics, it will be relatively easy to grasp the risks. The first is whether the job market will recover as scheduled, and the second is the risk of rekindling inflation. In addition, there is a news that attracted the author's attention, that is, Nirvana Finance, a stable project on Solana, announced the restart of V2. This project was suspended after being hacked for more than 3.5 million US dollars in July 2022. I remember that there was It is known that the hackers who attacked the project were convicted, and the recent restart means that the relevant judicial agencies should have completed the transfer of the stolen funds, which means that the entire incident should be defined as the first smart contract-related incident in the United States. The case of being convicted of an attack is of landmark significance to the maritime law system. After this, the handling process of similar cases should be significantly improved. Therefore, I spent some time over the weekend to sort out the whole story of this case in detail and share it with you.
Background of Nirvana Finance’s flash loan attack
I don’t know how many of you know about this project, so let me briefly describe the background information of the whole incident. First of all, Nirvana Finance is an algorithmic stablecoin project on Solana, which I will not elaborate on here. This project was launched in early 2022 and was hacked on July 28, 2022, and all the collateral of the stablecoin NIRV in the protocol was stolen, about 3.5 million US dollars. The details of the specific attack are also very interesting. Since the contract of the project is not open source, hackers can still make profits with the help of Solend’s flash loan function. At that time, the team also faced a lot of accusations of embezzlement.
In addition, before the theft, the project claimed that it had completed an "automated audit", but in fact this did not work. In a later interview with Cointelegraph, Alex Hoffman, co-founder of Solana, described that the team had already started the audit work the week of the attack. According to him, in fact, he did not expect Nirvana Finance to receive so much attention at the beginning of development, until it attracted the attention of several Chinese news media, causing TVL to soar. This is of course understandable. At that time, when Luna was in its heyday, the algorithmic stablecoin track naturally received widespread attention. After the success of the launch, Anatoly Yakovenko, the CEO of Solana at the time, also personally urged him to conduct a smart contract audit and try to move it forward in the audit company's schedule.
After the collateral was stolen, the project came to a standstill, but its Discord community has been maintained by official personnel. During this process, the community has been monitoring the stolen funds, but because the hacker eventually chose tornado and Monero to isolate them, there was actually no gain in recovering them. Things took a turn for the better on December 14, 2023, when a senior software security engineer named Shakeeb Ahmed, who had worked at Amazon, pleaded guilty in the Southern District Court of New York to a computer fraud charge related to the hacking of Nirvana Finance and an unnamed decentralized cryptocurrency exchange. The U.S. Attorney's Office also stated that this was the first case ever to be convicted of a hacker attack on a smart contract.
Of course, the founder did not stop after the project was attacked, and turned to develop other projects, superposition finance and concordia systems. This is also the benefit of maintaining a certain degree of anonymity, at least Fud will not be transferred. Then the case was sentenced on April 15, 2024, and Shakeeb Ahmed was sentenced to three years in prison for hacking and defrauding two cryptocurrency exchanges. Then on June 6, the stolen funds were transferred back to the team's designated account, which means that the stolen funds of the project have been officially recovered.
In fact, the source of the entire case should be Crema Finance, and Nirvana Finance was targeted after the hacker was captured and confessed.
In fact, the 34-year-old software security engineer was a senior security engineer at an international technology company at the time of the attack, specializing in smart contracts and blockchain auditing. He is also proficient in software reverse engineering, which explains why Nirvana was attacked before it was open source. The so-called reverse engineering is to use some decompilation software to reverse some compiled executable codes back to the high-level language before compilation, so that it is human-readable. Although the corresponding contract is not open source, in fact all the compiled codes of the smart contract are stored on the chain, and developers who are proficient in this technology can easily obtain it.
According to documents later released by the U.S. Department of Justice, the source of the entire case was a decentralized exchange that was attacked in July 2022 and lost $9 million. Through comparison, it was judged to be Crema Finance. On July 4, 2022, Shakeeb Ahmed also attacked the platform through a flash loan, and proposed a "white hat bounty" of $2.5 million to redeem other user assets and give up prosecution of the hacker. In the end, Crema Finance announced that it agreed to accept a "white hat bounty" of approximately $1.68 million.
The document states that Nirvana Finance was targeted after the hacker was captured and confessed. In the evidence for Shakeeb Ahmed's conviction, in addition to redeeming the browsing history of web pages on his personal computer and finding some relevant content, it also describes that after launching these attacks, he used many means, including some mixing protocols, Tornado and Monero to confuse. This raises an interesting question: what did Shakeeb Ahmed do to get him arrested?
There may be two answers. First, according to SolanaFM's analysis at the time of the attack, the attacker either interacted with the Huobi exchange address or interacted with the nested exchange address associated with Huobi. Because the initial funds of the attack address came from this. Secondly, it was the mistake in using Tornado Cash. Since Tornado Cash's ability to confuse funds is related to the time it is deposited and lasts, the degree of confusion will only increase if it is deposited for a long enough time and there are more redemption transactions during this period. Shortly after the attack, a redemption transaction occurred very shortly after Ahmed deposited the funds into Tornado, and the redeemed funds eventually entered the centralized exchange Gemini. This seems to indicate that the judicial authorities cooperated with the above two centralized exchanges to locate Shakeeb Ahmed and eventually arrested him in New York.
In any case, the recovery of stolen funds is a good thing, and this also reflects two issues. First, for DApp developers, fund security is a dimension that must be considered. Secondly, such cases now have a blueprint for handling, which should have a certain deterrent effect on related behaviors.
