Hackers are holding an unnamed crypto exchange to ransom after an alleged cyber-attack forced the Ethereum blockchain to facilitate two separate transactions at a cost of $5.2 million in fees, new information suggests.
The hackers may have gained access to the exchange’s funds but failed to transfer the money into their own wallets because of a security setting that demands multiple passwords to process a transaction.
Now they have turned to blackmail, trying to arm-twist the concerned platform into paying a ransom, according to Ethereum (ETH) co-founder Vitalik Buterin.
Explaining the suspicious transactions, Buterin tweeted on June 12 that: “Hackers captured partial access to exchange key; they can’t withdraw but can send no-effect txs with any gas price. So they threaten to ‘burn’ all funds via tx fees unless compensated.”
In the last few days, three ETH transactions took place: a customer paid $2.6 million to send $134 worth of ether. Few hours later, the same individual transferred $86,000 of ETH for precisely the same fee. A third transaction by a different user paid $500,000 in fees, but it’s unrelated to the blackmail attack.
Until now, the deals have been explained away as either a bug, money laundering or tax evasion. Others suspect human error.
A new report, however, turns the scales. Focusing on the two $5.2 million transactions, Chinese crypto analytics firm Peckshield concludes that the extraordinary ethereum transfer ‘blunders’ are the result of “gas price ransomware attacks.”
Researchers explain how the hackers gained access to the exchange’s funds and servers through phishing, granting them permission to send money to trusted wallet addresses under the platform’s database, just not their own.
The multi-signature security setting on the platform prevented the thieves from making transfers to their own accounts, but there was a loophole that allowed them to transact to addresses that require single authorization.
So, they have weaponized their stolen authority, sending very small amounts at ridiculously high transaction fees, to force payment. According to the report, the hackers still have access to 21,000 ETH ($5 million) that “if the exchange does not give a certain ransom through other means, the hackers will further spend the money.”
In another tweet, Vitalik Buterin offered a different explanation. “Similar situations could happen in ‘scorched earth’ games, including scorched-earth vaults aka ‘Moeser-Eyal-Sirer’ vaults as well as scenarios where hackers can slash but not steal staked funds,” he said.
What do you think about this ongoing ethereum fees debacle? Let us know in the comments section below.
Image Credits: Shutterstock, Pixabay, Wiki Commons