2020 has not only ravaged life as we know it, but also shaken the cryptocurrency industry. This year alone marks an overwhelming 6 hacks to major crypto currency exchanges. The most recent of these was the KuCoin Hack. According to estimates prepared by The Block analyst Larry Chermak, hackers were able to steal about $280 million in USDT, Velo, Orion, Ocean Protocol, and other tokens. This attack is the third largest in history and understandably extremely challenging to resolve.
GiveOnLIVE’s #BreakingTalks hosts virtual talk shows reacting to noteworthy current events in technology. We had the pleasure of interviewing Neil Conlon, cybersecurity expert and Anatoly Ressin, blockchain architect at Parsiq. The following recaps important details and exciting findings about the KuCoin hack.
Method of hacking
The exact method that KuCoin hackers used to obtain access and to acquire the funds is still under investigation. The hack was admitted due to the principle of splitting the risks used by most exchanges.
- Cold wallets are used to store a majority of coin balances. This type of wallet cannot be hacked since it’s not connected to the Internet.
- Hot wallets, which are connected and accessible via the Internet, serve as the operational balances for the sake of speed.
When asked how exchanges could avoid hacks, both Niel and Anatoly agreed:
“If something is connected to the Internet, it by definition means that it’s insecure.”
Update: KuCoin claims to have been able to identify suspects in the recent hacking of the platform and stealing about $280 million. According to Johny Liu, the exchange is returning to full operation. The BTC, ETH, and USDT have now resumed.
Method of funds recovering
- Some centralized tokens like USDT (ERC-20) have mechanisms on how to lock specific addresses or even forcibly move funds from one address to another. They've simply blocked the hacker’s wallets and returned stolen funds to KuCoin.
- To counter money laundering, many DeFi projects have transferred their tokens to new smart contracts. Such measures were taken by Ocean Protocol, Akropolis, Covesting, Silent Notary, and other affected market participants.
- Those ERC20 Tokens that were based on upgradeable Smart Contracts would have less problems than others, since the only effort would include implementing an upgraded version of a Smart Contract (i.e. blocking or removing hackers funds) that would reside on the same address.
Anatoly explains on the show:
“By definition of the blockchain if something has moved out of your wallet, it means that you cannot recover it.”
He rehashed the situation involving the DAO project when Vitalik Buterin decided to hard-fork the Ethereum network. Now we have Ethereum and Ethereum Classic, where the hack is still present.
PARSIQ Snapshots technology
Together with KuCoin engineers, PARSIQ team implemented a recovery plan, with the main idea: replace the hacked token’s smart contract by using a balance distribution snapshot prior to the hack.
Anatoly elaborates:
“With the help of Parsiq technology (and because we can see everything that happens in the blockchain), we recreated these tokens with exactly the same balances that were present before the hack.”
Two essential parts of token uniqueness are Utility and Distribution. Utility means that a particular token has a meaningful role in the functioning of some software or ecosystem. The Distribution means that there are many users that are holding this token while expecting to use it for its Utility or any other reason.
In order to swap token A to a token B and pretend nothing happened, the token ecosystem needs to be fixed in two essential parts.
- Project corresponding software should be fixed so that token B is now used instead of token A. This is a forcible transfer of the Utility.
- Token B should be distributed exactly among the A token holders - in the same proportion - except the hacker’s wallet. This is called a restoring distribution.
This is the quick reacting solution offered by Parsiq to protect projects and support KuCoin’s relief efforts.
Anatoly added:
“The Parsiq team is constantly monitoring what is happening with the hacker's address and have the latest snapshots of the state of the Token holder balances prior to the hack. And we could provide this information to those token projects who will decide to fork.”
Bonus: Watch the LIVE interview on GiveOnLIVE! with Anatoly to learn about community reaction, ‘cursing’ tokens specially created for the KuCoin hacker.
The snapshot itself is a simple CSV file so it could be easily opened in excel or google spreadsheets. The size of this file depends on how many active addresses with non-zero balances had existed at the time when the snapshot was made.
Unfortunately, the Ethereum blockchain doesn’t allow users to obtain the entire set of balances at the given moment without replaying all the history. Thus, it is impossible to create a snapshot without having all blocks starting from the token's contract deployment.
Nevertheless, PARSIQ software resulted quite suitable for this task. The team is able to take a snapshot of young projects in a matter of minutes.
#ParsiqSavesTheDay
Parsiq started by helping NOIA Network and will provide snapshots for other projects as well. NOIA ERC20 tokens will be reissued 1:1 via a new smart contract, and automatically distributed to the holders of the previous token. The CarVertical team also joined the movement and took the snapshot to create new cV tokens.
The Snapshot database holds all 152 projects that got robbed by the hacker, even if he’d stolen only one single token. The team is actively adding snapshots to a separate landing page:
In the desperate hours after a hack, this quick-witted PARSIQ team armed with their revolutionary technology put all their effort to support KuCoin and the projects affected. When asked WHY the leadership decided to step in, Anatoly said:
“We feel it is our moral obligation because we have the technology that could potentially save a really cool project at their start.”
PARSIQ team is also open to helping projects with further actions required for hard-forking:
“We are able not only to provide ideas of snapshots, but we also have huge experience with smart contract deployment optimizations of gas and so on, so we could help you hard-fork your token.”
Bonus: Watch the LIVE Interview with Anatoly Ressin to have a better understanding of blockchain Oracles on GiveOnLIVE! channel #DigeconLIVE.
Learn more about GiveOnLIVE! Mission for creating immersive experiences and empowering creators around the world.
For inquiries contact
ChristyAna Viva @ACTJust
Executive Producer, GiveOnLIVE! #TechStream
Email: [email protected]