post-title Hacker Exploits Flaw in Decentralized Bitcoin Exchange Bisq to Steal $250K

Hacker Exploits Flaw in Decentralized Bitcoin Exchange Bisq to Steal $250K

Hacker Exploits Flaw in Decentralized Bitcoin Exchange Bisq to Steal $250K
Cryptocurrencies News

Decentralized exchange (DEX) Bisq rang the alarm bells last night after a hacker exploited a significant software flaw to steal more than $250,000 worth of cryptocurrency from users.

Bisq, which allows users to exchange crypto anonymously, abruptly disabled trading late Tuesday night after it uncovered “a critical security vulnerability.”

At the time, the exchange did not release any information regarding the nature of the flaw or whether user funds were safe. But 18 hours after it halted trading, Bisq said it took the “unprecedented” step after finding an attacker was exploiting a flaw in the software to steal cryptocurrency from other users.

“About 24 hours ago, we discovered that an attacker was able to exploit a flaw in the Bisq trade protocol, targeting individual trades in order to steal trading capital. We are aware of approximately 3 BTC and 4,000 XMR stolen from 7 different victims. This is the situation as we know it so far,” Bisq said in a statement to CoinDesk.

The value of the crypto stolen was roughly $22,000 worth of bitcoin (BTC) and $230,000 worth of monero (XMR), according to CoinDesk data at press time. In total, that comes to more than $250,000.

To carry out the thefts, the attacker was able to set other users’ default fallback address – the destination to which crypto is sent to if a trade fails – to their own. Posing as a seller, they would start a trade with a buyer and simply wait for the time limit to run out. Rather than going to the legitimate owner, the digital assets arrived with the attacker, along with the buyer’s payment and security deposit too.

The flaw in question came as part of a recent update to the trading protocol, which was designed to improve decentralization and remove trusted third parties from the platform.

Bisq managed to fix the flaw by 12:00 UTC Wednesday and told CoinDesk just before publication that trading had just resumed again.

Bisq released onto testnet back in late 2018 as an exchange structured as a decentralized autonomous organization (DAO). It works in much the same way as other DEXs, but users can trade anonymously as there are no registration or identity verification requirements.

With the platform based on a distributed network, each user effectively acts as a node. Although Bisq’s developers had suspended trading, the exchange’s decentralized nature means users could override the suspension should they wish.

In most cases of an exchange hack, the attacker can be booted off the trading platform for good. Not so with Bisq. One of the DEX’s associated developers told CoinDesk that although the flaw was fixed, there was nothing to prevent the attacker – whose identity cannot be known – from accessing and trading on the platform again.

“Anyone can use Bisq, there is no censorship,” the developer said. “Just like anyone can use bitcoin, there is no way to ban someone from bitcoin.”

Disclosure Read More

The leader in blockchain news, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups.

About Juan Rodulfo

Defined by Nature: Planet Earth Habitant, Human, Son of Eladio Rodulfo & Briceida Moya, Brother of Gabriela, Gustavo & Katiuska, Father of Gabriel & Sofia; Defined by the Society: Venezuelan Citizen (Human Rights Limited by default), Friend of many, Enemy of few, Neighbor, Student/Teacher/Student, Worker/Supervisor/Manager/Leader/Worker, Husband of Katty/ Ex-Husband of K/Husband of Yohana; Defined by the US Immigration System: Legal Alien; Defined by the Gig Economy: Independent Contractor Form 1099; Studies in classroom: Master Degree in Human Resources Management, English, Chinese Mandarin; Studies at the real world: Human Behavior; Studies at home: Webmaster SEO, Graphic Web Apps Design, Internet & Social Media Marketing, Video Production, You Tube Branding, Trading, Import-Exports, Affiliate Marketing, Cooking, Laundry, Home Cleaning; Work experience: Public-Private-Entrepreneur Sectors; Other Definitions: Bitcoin Evangelist, Human Rights Peace and Love Advocate. Author of: Why Maslow: How to use his theory to stay in Power Forever (EN/SP); Asylum Seekers (EN/SP); Manual for Gorillas: 9 Rules to be the “Fer-pect” Dictator (EN/SP); Why you must Play the Lottery (EN/SP); Para Español Oprima #2: Speaking Spanish in Times of Xenophobia (EN/SP). Social Media profiles: Twitter/FB/Instagram/VK/Linkedin/Sina Weibo: @rodulfox
%d bloggers like this: