Phantom 钱包不会受到Solana供应链攻击
Phantom 钱包是安全的，尽管有人猜测它可能已在Solana供应链攻击中遭到破坏。在将恶意代码注入Solana的 Web3 JS 库后， Solana用户遭到暴露。
Phantom 钱包宣布它没有受到Solana供应链攻击的影响，该攻击是在开源 Web3 库之一中发现的。尽管可能有未知数量的用户受到影响，但该钱包并未报告任何漏洞。钱包本身不使用任何受损版本。
Phantom 不受此漏洞的影响。
我们的安全团队确认我们从未使用过 @ solana /web3.js 的被利用版本https://t.co/9wHZ4cnwa1
—幻影 (@phantom) 2024 年 12 月 3 日
Solana builders and users may have been exposed to two malicious versions of web3.js, 1.95.6 and 1.96.7. The earlier version is safe, as well as an upgrade to version 1.95.8.
The attack was noticed on December 2 and it affected apps, bots, and custodial services. The widely used library contained code that requested and broadcast private keys, thus compromising user wallets.
Based on the records of the Anza development firm, the account was exposed for around 5 hours on December 2, which limited the number of potential downloads during that time window.
The suspected versions were immediately unpublished, but apps and projects may have their multisig or other credentials exposed.
For now, there is no data about any major Solana apps or accounts changing their wallets or storage. The last transaction to the exploiter wallet was from December 3, further suggesting the exploit affected a limited number of users.
In the meantime, one of the identified wallets is moving funds to a new account with a high balance of SOL and other assets, including Jupiter (JUP). The new account has been identified as a high-balance wallet by Nansen. None of the proceeds from the hack have been traded or disguised, as with other hacks.
Limited gains from Solana wallets drained in exploit
While far-reaching, the attack did not seem to affect high-value wallets. The identified exploiter wallet withdrew around $160K in SOL and nine tokens valued at $31,300. The attacker ended up testing wallets with billions of transaction requests, suggesting there may be many more unknown affected wallets.
One of the reasons for the limited exploit haul is that the Solana network still has more than 35% failure rate for its transactions. However, the attempts suggest the exploiter may have gained more private keys through exposed apps.
The attack happened through a social engineering attack, which allowed the malicious actors to gain access to the web3.js library depository. Reportedly, the project’s builders received a phishing link where the attackers requested and gained access. The malicious dataset has been flagged and is available for researchers through GitHub.
Supply chain attacks emerged in the past year, with Lottie player also used as a vector to gain access to wallets. However, a direct targeting of private keys is a more rare type of attack. In the case of Solana apps, the exploiter managed to obtain private keys since some apps also required the same information for legitimate purposes.
While most Solana apps have proven safe, the recent influx of new retail users is exposing some of the potential vulnerabilities.
Responsibility for code dependencies and usage lies with projects. With fast building, the web3.js library has been downloaded more than 350K to 400K times in a week, leading to wider potential exposure.
Solana wallet attacks are a key risk
Solana drainers are becoming more active, and one of the few things that prevents bigger exploits is the fact that most wallets still contain under 1 SOL.
One of the risks is that once exposed to a drainer, a Solana wallet is always at risk. Solana wallets also cannot revoke their permissions as in Ethereum.
The Solana network is still not as heavily exploited as Ethereum, but has a prevalence of attacks against personal wallets. One of the vectors include Telegram, which can be connected to a Solana wallet for bot usage or easier trading.
Using the same Telegram credentials also means that the wallet may be exposed and drained by malicious apps. The best approach is to use a dedicated wallet for storage, and another one for Web3 tasks.
Land a High-Paying Web3 Job in 90 Days: The Ultimate Roadmap
相关文章
破冰！马斯克与特朗普“握手言和”，白宫合作有望重启？
TradingKey - 在经历数月公开决裂后，美国总统特朗普与特斯拉CEO埃隆·马斯克于当地时间9月21日在亚利桑那州一场保守派活动家查理·柯克的追悼会上罕见同框。这是两人自5月底因“大而美”财政法案激烈争吵以来，首次被拍到共同现身并互动。
黄金交易提醒：涨势停不下！美联储降息后，金价直奔4000美元大关？
上周全球黄金市场再度迎来里程碑时刻。上周三美联储宣布降息25个基点后，现货黄金价格一度冲至3707.40美元/盎司的历史新高，尽管随后出现震荡回调，但上周五收盘仍站稳3684.93美元，周线涨幅达1.15%，实现连续第五周上涨。市场分析师普遍认为，黄金的看涨基调并未因短期波动而改变。
董镇元9月22日：周线大阳临压力，金银本周延低多
上周黄金市场周初开盘在3642.9的位置后行情先回落给出3626.2的周线低点后行情强势拉升，周线最高触及到了3670.5的位置后行情冲高回落，二次给出周线低点附近后行情尾盘拉升， 周线最终收线在了3684.9的位置后行情以一根上下影线等长的大阳线收线，而这样的形态收尾后，本周行情有继续看多需求，点位上，下方3325和3322的多和上周3368-3370的多和3377和3385多和3563的多减仓后止损跟进在3570持有，今日早盘先回落3672多止损3666，目标看3692和3700，破位看3707历史压力争夺，破位的话看3712和3721和3732压力点。
