Key takeaways:
- In an incident on July 16, over $10 million worth of cryptocurrency was taken from Li.Fi, an API for Solana bridge and Ethereum Virtual Machine.
- On July 16, Li.Fi issued a warning to its community via an X post, advising users not to utilize Li.Fi-powered applications until further notice.
In an incident on July 16, over $10 million worth of cryptocurrency was taken from Li.Fi, an API for Solana bridge and Ethereum Virtual Machine.
Cyvers claims that the team’s systems warned of questionable Li.Fi transactions involving a particular contract address.
Users are advised by Cyvers to cancel their authorization for the following suspected address: 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae.
Cyvers’ co-founder and chief technical officer, Meir Dolev, clarified why strict rules are necessary:
“Hackers can exploit these approvals to drain both assets stored in the contracts and funds in the connected wallets of users.”
On July 16, Li.Fi issued a warning to its community via an X post, advising users not to utilise Li.Fi-powered applications until further notice.
When the attack started, the team made it clear that customers who “did not set infinite approval” were not in danger and that they were looking into the exploit.
The Li.Fi team advised revoking the following addresses from users who had manually established limitless approvals: “0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae, 0x341e94069f53234fE6DabeF707aD424830525715, 0xDE1E598b81620773454588B85D6b5D4eEC32573e, and 0x24ca98fB6972F5eE05f0dB00595c7f68D9FaFd68”
Li.Fi informed its consumers that the smart contract vulnerability had been fixed in an X post at 11:44 am ET (15:44 UTC). The post said that users are not at risk at this time. The post went on to say:
“The only wallets affected were set to infinite approvals, and represented only a very small number of users.”
Cyvers claims that the loss of almost $10 million in bitcoin holdings also had an impact on the Arbitrum blockchain.
Cyvers once again advised users to revoke the 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae address in order to stop additional losses in an X post informing the community of the situation.
Protocol for decentralized finance On July 12, Dough Finance was the target of a $1.8 million flash loan attack, which also occurred recently.
When Cyvers reported on the issue, they clarified that the attacker exchanged the stolen USD coins for Ether (ETH) and funded the attack via the zero-knowledge protocol Railgun.
The exploit, which amassed 608 ETH and is estimated to be worth $1.8 million, originated from unvalidated call data via the “ConnectorDeleverageParaswap,” according to Web3 security company Olympix.
