TL;DR
- The LiFi protocol fell victim to a sophisticated cyber attack resulting in the theft of over $8 million. Exploiting “infinite approvals” configurations.
- Users have been urged to avoid interacting with LiFi-powered apps and to revoke all approvals for specific addresses to mitigate any risks.
- The identification of four new vulnerabilities underscores the serious exposure of users.
A recent incident has shaken the decentralized finance (DeFi) sector. The LiFi protocol was targeted in a sophisticated cyber attack resulting in the theft of more than $8 million. This protocol, known for bridging different blockchains, was breached by a hacker exploiting specific “infinite approvals” settings on particular accounts.
The hacking, detected last Tuesday, prompted LiFi protocol administrators to issue an urgent warning to all users to refrain from interacting with any LiFi-powered applications until further notice. Additionally, users have been advised to revoke all approvals set for three specific addresses in an effort to mitigate risk and protect remaining user funds.
Please do not interact with any https://t.co/nlZEnqOyQz powered applications for now!
We're investigating a potential exploit. If you did not set infinite approval, you are not at risk.
Only users that have manually set infinite approvals seem to be affected.
Revoke all…
— LI.FI (@lifiprotocol) July 16, 2024
The severity of the incident is underscored by the identification of four new security vulnerabilities in the protocol. Indicating dangerous exposure for those who have actively used LiFi for transactions. Despite a swift response from the development team to address the vulnerabilities, the impact on user funds remains a cause for concern.
LiFi Urges Caution Among Users to Prevent Losses
The attack highlights once again the persistent security challenges within the DeFi economy. The decentralized nature often presents opportunities for cybercriminals. Security firms like Cyvers and De.Fi Antivirus Web 3 have warned about the scope of the exploit. Affecting approvals for stablecoins such as USDT and USDC on the Ethereum network, and Arbitrum.
Furthermore, it was revealed that the attacker executed multiple suspicious withdrawals from the protocol’s contracts. Using a wallet now containing the $8 million loot in various cryptocurrencies on Ethereum and Arbitrum networks.
It is crucial to remind the community to maintain rigorous security practices and be vigilant about permission settings on DeFi platforms. Immediate and collaborative responses between users and security firms are vital to mitigate risks and safeguard digital assets.
