SEC - Page 186

Hardware wallet provider Ledger and cryptocurrency exchange Coinbase have announced a partnership aimed at simplifying crypto purchases and facilitating the transfer of assets from exchanges to self-custody.

In a statement to Cointelegraph, the Ledger team emphasised that Coinbase’s on-ramp solution, Coinbase Pay, will be seamlessly integrated into the Ledger Live application.

This integration enables users to transfer their existing crypto holdings and conduct transactions directly from their desktop or mobile devices, with the added convenience of receiving crypto purchases directly on their Ledger devices.

Describing the previous process of moving crypto from an exchange to self-custody as “a cumbersome process that left users vulnerable to potential errors,” Ian Rogers, Chief Experience Officer at Ledger, remarked that before the collaboration, buying and transferring crypto was “a tedious process.”

However, Rogers expressed confidence that the integration has significantly simplified the process, likening it to the way travel agency Skyscanner simplified travel bookings.

READ MORE: Google Launches £21.4 Million AI Training Fund to Empower European Workforce

He elaborated, stating, “This integration makes it much easier for crypto users to buy through Coinbase and have the funds directly deposited to the secure self-custody of their Ledger.”

Addressing potential changes in the demand for self-custody, Rogers suggested that, similar to different bank accounts, there will be various wallet options.

He indicated that the collaboration with Coinbase demonstrates to consumers that they have a choice. Rogers further noted that the integration makes the experience more straightforward for newcomers to self-custody, affirming, “At the end of the day, you have the option to choose digital ownership through self-custody.”

According to the Ledger team, the crypto industry is entering a new phase driven by the recent introduction of spot Bitcoin exchange-traded funds (ETFs). Ledger anticipates that this development will attract new users to the crypto space.

While these users may initially engage with ETFs, Ledger hopes they will eventually opt for self-custody, which the wallet provider identifies as “the true use case for crypto.”

Discover the Crypto Intelligence Blockchain Council

Solana’s SOL token has overtaken Binance’s BNB token to secure the position of the fourth-largest cryptocurrency by market capitalisation.

Over the span of 24 hours leading up to 1:50 pm UTC, SOL experienced a notable surge of 7.56%, reaching a trading value of $112.52, surpassing BNB.

According to CoinMarketCap data, SOL now boasts a market capitalisation of $49.36 billion, which is 1.74% greater than BNB’s $48.5 billion.

This rise in SOL’s price coincided with the Crypto Fear and Greed Index reaching its highest level since November 2021, when Bitcoin soared to $69,000.

Notably, this index surged a day after Bitcoin exceeded $50,000 for the first time since December 2021.

Despite encountering a network outage on February 6, SOL managed to outpace BNB.

The approval of the Pyth DAO Constitution on-chain likely served as a catalyst for this rally.

The proposal aimed to establish the Pyth DAO Constitution as the governing framework for the Pyth DAO, an autonomous organisation overseeing the Pyth Network.

READ MORE: Blockchain Academy Initiative Gains Traction Among Young Entrepreneurs in UAE

Despite the recent setback, SOL has gained 19.99% over the past seven days, albeit remaining 57% lower than its all-time high of $260.06, recorded on November 6, 2021.

Solana Mobile’s Chapter 2 smartphone garnered 100,000 pre-orders by February 12, within a span of less than 30 days.

In contrast, it took Solana nearly a year to sell 20,000 units of its inaugural Solana Saga smartphones.

Following this achievement, the pre-order window for purchasing the new Solana phone for $450 is set to close on February 14, as announced by Solana Mobile.

Shipments of the smartphones are expected to commence in early 2025.

Meanwhile, BNB has been grappling with challenges amid Binance’s regulatory issues.

On February 12, the sentencing date for Binance founder Changpeng Zhao was postponed from February 23 to April 30. Zhao, currently on a $175 million bond, is residing in the United States.

Discover the Crypto Intelligence Blockchain Council

Investors of the Hector decentralised autonomous organisation, HectorDAO, on the Fantom network are demanding control of the protocol’s remaining funds after the team allegedly halted all communications following a Jan. 16 hack that led to $2.7 million in losses.

In a conversation with Cointelegraph, a HectorDAO investor who wishes to remain anonymous stated that the HectorDAO team stopped communicating with its community on Jan. 19.

According to the source, all project social channels were muted in September 2023.

At that time, the HectorDAO team still allowed contact through a Google Group email address. However, the DAO allegedly deleted this group sometime before Jan. 19.

To make matters worse, the hack occurred just as the protocol planned to dissolve itself and return assets to investors. Prior security warnings were allegedly ignored.

According to blockchain security firm CertiK, its researchers informed the HectorDAO team of the “centralisation” risk posed by the “addEligibleWallet” function, the root cause of the exploit, and recommended steps to mitigate this risk.

The HectorDAO team allegedly chose not to implement the recommended changes for unknown reasons CertiK referred Cointelegraph to its official audit report, which stated that the function could be called by any account with moderator privileges.

HectorDAO tells a different version of the story, claiming that the protocol engaged with CertiK to conduct a thorough smart contract security analysis and that, contrary to CertiK’s statement, “all assets were secured in a Redemption Vault prior to the launch of the production claim process.”

Blockchain analysis has since shown that the attacker allegedly had access to the team’s deployer account, implying that the exploit was either an inside job or the result of a private key compromise.

The development team’s last known communication to investors was on Jan. 18, before going quiet.

The story of HectorDAO begins in 2021, when its early investors were allowed to buy the DAO’s token, HEC, at a discount through DAO bonds.

The funds raised through this process went into the DAO’s treasury, where, theoretically, each HEC token represented ownership of a portion of the treasury, which could be reinvested to produce yield for tokenholders.

At its height, the HectorDAO treasury held over $100 million in digital assets.

But troubles began with the onset of the crypto winter.

By 1st May 2023, HEC’s price had collapsed by nearly 99%, according to data from CoinMarketCap. At the same time, the HectorDAO treasury also declined in value.

These difficulties accelerated when the $1.5 billion Multichain bridge hack on 6th July 2023 caused contagion in the Fantom ecosystem.

This led to another $8 million in losses for HectorDAO, as some of its treasury assets depegged from their Ethereum collateral.

After this incident, HectorDAO investors decided to call it quits, voting in July 2023 to liquidate the DAO and return its funds to users.

Despite the vote, however, most of the $16 million held by the treasury at the time of the vote had yet to be distributed to investors by 15th Jan 2024, on the eve of the HectorDAO hack.

On 15th Jan, the HectorDAO team attempted to finally distribute treasury funds by moving them into a new contract from which they could be redeemed.

However, a malicious account immediately transferred $2.7 million worth of assets to itself after depositing only 0.0001 HEC.

READ MORE: Crypto.com Defends Major Sponsorship Deals with F1 and UFC

Shortly afterward, the team shut down the redemption platform, and all remaining assets were moved back to the treasury contract. The redemptions have not been reopened since.

On 18th Jan, the HectorDAO team announced that the redemption platform had been hacked.

“Hector Network regrets to inform you that there has been a security breach when the protocol was redeeming token holders as part of liquidation, and approximately USDC 2.7 million have been stolen on 15 January 2024,” it stated.

The team claimed it was “actively investigating” the breach and would provide updates in the future. In the meantime, it stated, “the redemption process is postponed for now.”

In the wake of the hack announcement, some tokenholders squarely blamed the development team, claiming that the hack was either the work of a rogue developer or a compromised private key.

They argued that the team could no longer be trusted to secure the DAO’s funds.

On 19th Jan, blockchain analyst Lilbagscientist released a detailed post-mortem report on the attack, citing data from Etherscan.

According to them, preparations for the attack began on 16th Dec 2023, when the HectorDAO deployer account sent 0.0001 HEC to the attacker. This 0.0001 HEC sat in the account until 15th Jan.

From 12:32 am UTC through 12:43 am on 15th Jan, a series of 14 transactions were submitted to Ethereum by the HectorDAO team’s Treasury Multisig Wallet.

When confirmed, these transactions resulted in some of the treasury funds being moved to the HectorDAO Temporary Treasury Multisig, while others were sent to the Hector Liquidation Manager.

The Hector Liquidation Manager then swapped some of the tokens for others on a decentralised exchange before sending them to the Temporary Treasury Multisig.

At the end of this process, the entirety of the HectorDAO treasury had been sent to the Temporary Treasury Multisig.

Between 3:14 am and 4:19 am on 15th Jan, an additional 16 transactions were performed by the Temporary Treasury Multisig, moving the funds to the Hector Redemption Treasury contract.

At 5:12 am, the attacker made a token approval, allowing up to 1 HEC to be spent by the Hector Redemption Contract. Immediately afterward, they deposited 0.0001 HEC into the contract.

One minute later, the team’s deployer account whitelisted the attacker’s wallet by calling the addEligibleWallet function on the platform’s Token Vault contract.

This transaction also set the rate of redemption at $2.7 million worth of USD Coin.

At 5:59 am, the attacker called mintWithdraw on the Token Vault contract.

This caused the Hector Redemption Contract to send $2.7 million in USDC to the attacker and burn the 0.0001 HEC that had been deposited. This transaction completed the attack.

The HectorDAO website’s most recent update was posted on 18th Jan. The last paragraph states that the redemption process is “postponed for now.”

“Hector Network is working tirelessly to address this, is committed to maintaining transparency throughout this process and will keep you updated on any developments,” the team wrote.

Meanwhile, HectorDAO investors say that they are considering legal action amid repeated failed efforts to contact the protocol’s developers.

Originally, payments were scheduled for March to compensate investors as the DAO liquidates. An investigation into the hack continues.

Cointelegraph attempted to contact the HectorDAO team for comment but did not receive a response by the time of publication.

Discover the Crypto Intelligence Blockchain Council

Blowfish, a Web3 security firm, has uncovered two fresh Solana drainers capable of executing bit-flip attacks, as disclosed in an analysis shared on the social media platform X on February 9.

The drainers, Aqua and Vanish, were identified altering a condition within on-chain data even after a user’s private key had authenticated a transaction.

Blowfish revealed that these drainers’ scripts are purchasable for a fee within marketplaces that peddle scam-as-a-service tools.

The Blowfish team elucidated the modus operandi employed by the drainers to manipulate data and pilfer funds:

“On Solana, a dApp can be granted authority to submit a transaction.

If the dApp’s on-chain program incorporates a condition permitting it to transfer the user SOL or drain their account, a drainer could manipulate that condition at any given moment,” the analysis expounded.

Initially, users remain oblivious to the presence of these drainers. The victim signs what seems to be a legitimate transaction.

However, subsequent to obtaining the signature, the drainer temporarily retains the transaction.

“Subsequently, via a separate transaction, they alter the dApp’s condition; it transitions from ostensibly sending SOL to seizing it instead.”

READ MORE: European Commission Proposes Mandate for Tech Platforms to Detect AI-Generated Content

A bit-flip attack represents a form of exploitation where the perpetrator alters the value of certain bits within encrypted data to manipulate a system.

This tactic enables the attacker to modify the encrypted message sans knowledge of the encryption key.

By flipping specific bits, an attacker can sometimes alter a message in a foreseeable manner post decryption.

The Solana ecosystem has witnessed an escalating onslaught from crypto drainers.

According to Chainalysis, a leading online community centred around a single Solana wallet drainer kit boasted over 6,000 members as of January.

Brian Carter, senior intelligence analyst at Chainalysis, previously conveyed to Cointelegraph that the most effective draining kits possess the ability to target numerous assets through diverse means.

Allegedly, the Blowfish team has implemented defensive measures to automatically thwart the newly identified drainers and is actively monitoring on-chain activities.

Discover the Crypto Intelligence Blockchain Council