Solana, Nomad Hit in Busy Two Days For Hackers

The Solana ecosystem has suffered a US$8 million exploit, after an unknown attacker(s) drained thousands of Solana wallets of their SOL tokens and USDC.

The hack seems to have originated on the Solana browser wallet Phantom, and is believed to have compromised the private keys of users.

“Over 5,000 Solana wallets have been drained in the past few hours,” blockchain audit firm OtterSec reported. “These transactions are being signed by the actual owners, suggesting some sort of private key compromise.

According to Twitter user @nftpeasant, as much as US$6 million were drained from Phantom wallets within a 10-minute period.

some exploit either with @phantom or @MagicEden, drained 6mil in like 10 mins literally every phantom wallet getting compromised, not sure if any other wallets too pic.twitter.com/dVtksoMeye
— Paladin (@nftpeasant) August 2, 2022

Phantom has since responded to the incident, stating that it is currently working to investigate a “reported vulnerability”.

“At this time, the team does not believe this is a Phantom-specific issue. As soon as we gather more information, we will issue an update”, it tweeted.

For reference I haven't interacted with any contracts at all in ~40 days. My ERC-20 and SPL USDC held on both @slope_finance and @TrustWallet were drained
— Justin.sol (@JustinBarlow) August 3, 2022

According to OtterSec, Ethereum users have also been affected, although the issue is “less widespread”. It is also unclear if the attacks are related or separate incidents. One Twitter user, @Justin.sol, claimed that he had used dApps that are on both Ethereum and Solana, resulting in both ERC-20 (Ethereum version) and SPL (Solana version) USDC being drained from his wallet.

Copy-paste hacking

The hack is hard on the heels of yesterday’s Nomad Bridge hack, which saw nearly US$200 million drained from the cross-chain protocol. It was also revealed that the person who hacked Lari Capital was the same one who hacked Nomad.

The hacker bypassed both the verification of transaction user requests and the processing of the trusted Merkle with 0x00 during routine storage updates and sent 0.01 WBTC to take 100 WBTC. Any user could find the transaction conducted by the hacker and then replace it with their own address, so many other actors took Nomad Bridge’s assets in the same way.

“For bridge services, operators can run off-chain operations alongside smart contract operations. This particular incident was caused by a combination of executions on the smart contract and vulnerabilities within operator operations,” Jasper Lee, audit tech lead at Sooho.io told Blockhead.

According to Chainalysis, approximately US$2 billion in cryptocurrency was stolen from cross-chain bridges across 13 separate hacks so far this year, with attacks on cross-chain bridges accounting for 69% of total funds stolen.