Decoding Stake’s $41 Million Exploit

Summary

On the 4th of September 2023, Stake, a betting platform, was hacked on Ethereum, Binance and Polygon chains. Around $41.3 Million was transferred to different accounts.

About Project

Stake.com is a crypto gambling application with casino and sports betting platforms for Bitcoin and other cryptocurrencies. To learn more about them, check out their website.

Vulnerability Analysis & Impact

On-Chain Details

Attacker Address: 0x3130662aece32f05753d00a7b95c0444150bcd3c

Victim Contract: 0x974caa59e49682cda0ad2bbe82983419a2ecc400

Attack Transaction: 0x98610e0a20b5ebb08c40e78b4d2271ae1fbd4fc3b8783b1bb7a5687918fad54e

The Root Cause

• Although the root cause is still unknown, one of the speculations suggests that the root cause of the hack was a compromise of the private key.

• This means that the attacker somehow got access to the private that gave him access to all the funds

• There are many reasons through which compromise of private keys can happen :

Social Engineering – The attacker tricks you into giving them your private key

Malicious Software – Once installed, they will steal private keys from your system

Supply Chain Attack – This involves targeting the weak link of the supply chain. In blockchain, these are usually employees with redundant access to the core.

Brute Force – This involves guessing the private key until the right combination is achieved.

Flow of Funds

The attack included $41M worth of cryptos being drained from

• $15.7M on Ethereum (9.62K ETH)

• $1.1 M USDC

• $3.9 M USDT

• $900k DAI

• 6000 ETH

• $7.85M on Polygon (14.24M MATIC), and

• $17.75M on BNBChain (82.65K BNB)

The attack seems to be very well-orchestrated

These are the addresses that are involved after the attack

ETH

0x3130662aece32f05753d00a7b95c0444150bcd3c

0x94f1b9b64e2932f6a2db338f616844400cd58e8a

0xba36735021a9ccd7582ebc7f70164794154ff30e

0xbda83686c90314cfbaaeb18db46723d83fdf0c83

0x7d84d78bb9b6044a45fa08b7fe109f2c8648ab4e

MATIC

0xfe3f568d58919b14aff72bd3f14e6f55bec6c4e0

0xa26213638f79f2ed98d474cbcb87551da909685e

0xf835cc6c36e2ae500b33193a3fabaa2ba8a2d3dc

0xa2e898180d0bc3713025d8590615a832397a8032

0x32860a05c8c5d0580de0d7eab0d4b6456c397ce2

BSC

0x4464e91002c63a623a8a218bd5dd1f041b61ec04

0x0004a76e39d33edfeac7fc3c8d3994f54428a0be

0x95b6656838a1d852dd1313c659581f36b2afb237

0xbcedc4f3855148df3ea5423ce758bda9f51630aa

0xe03a1ae400fa54283d5a1c4f8b89d3ca74afbd62

0xff29a52a538f1591235656f71135c24019bf82e5

Why QuillAudits For Web3 Security?

• QuillAudits is well-equipped with tools and expertise to provide cybersecurity solutions saving the loss of hundreds of protocols in funds.

• Our team of highly skilled auditors have secured over 1M lines of code and $30B in amount.

• Over the course of multiple years, QuillAudits has been proven to be one of the top choices for protocols to get their codebases audited.

Partner with QuillAudits

• OG Program (Opportunities for Listing Managers, KOLs, Top Advisors and Investors with access to early stage Web3 projects)

• QuillAudits Partnership Programme (Venture funds, launchpads, development companies, marketing firms, web2 cybersecurity firms, web3 products)

• WAGSI Program(Claim audit credits to avail exclusive discounts on our auditing package, and additional credits for our automated web3 security infra- QuillShield)