The CoinSec Podcast

Latest Episodes:

Episode 52: Jack Rhysider, Notional Critical Bug Bounty, Smart Contract AV, and North Korean Hackers Jan 19, 2022

Show notes

In episode 52 we were joined by Jack Rhysider from Darknet Diaries. He gave us additional insight into a story we covered in episode 44 around Coinbase accounts getting hacked. We also talked about a $1 million bug bounty that was paid out by Notional. DefiDollar successfully stopped a smart contract attack by having an early warning system in place that detected a malicious contract. LCX was hacked for $7.94 million in a hot wallet compromise. North Korean hackers are targeting crypto startups. Rarible is creating a tool to block risky NFT sales. Fees.wtf was hit by bots that drained their liquidity pool during their token launch.

Episode 51: Wallet Recovery, Critical Polygon Bug, Norton AV Cryptomining, Exploits, and Rug Pulls Jan 12, 2022

Show notes

2022 is already starting off hot for crypto hacks, scams and rug pulls. We recap 2021 as $14 billion were stolen in crypto-related incidents. A follow-up from episode 50 in regard to Polygon hard forking due to a critical bug was discussed. Norton Anti-virus has added a cryptomining feature to its Norton 360 software. Tinyman was hacked for $3 million. The first week of the new year saw rug pulls from Arbix Finance, $YEAR token, and Doodled Dragons NFT. A new smart contract auditing tool called SAILFISH claims to discover new vulnerabilities. $2.2 million in Bored Apes were frozen on OpenSea after being stolen. Steve walks us through a demo on how to recover/crack your lost wallet password.

Episode 50: Helium Mining, Polygon Hard Fork, Adidas NFT, Bent - Grim - Visor Hacks, Discord Hacks Jan 03, 2022

Show notes

In episode 50 we discussed the Helium network, how to mine HNT, and a hack for getting a miner. Multiple Discord hacks happened to various NFT projects. Grim Finance, Bent Finance, and Visor all dealt with hacks. Polygon silently hard forked.

Episode 49: Log4J Vuln, BadgerDAO Hack, MonoX Exploit, Multiple Key Compromises, Bored Ape $3k Sale Dec 17, 2021

Show notes

In this episode of the CoinSec Podcast we talked about the critical Log4J issue and how that may affect crypto-related software. BadgerDAO was compromised for $120 million due to an attacker gaining CloudFlare API access. Four different private key compromise stories were discussed in this episode for Vulcan Forged, AscendEX, Bitmart, and 8ight. MonoX was hacked for $31 million due to a smart contract vulnerability. Also, a man accidentally sold a Bored Ape for $3k instead of $300k.

Episode 48: ConstitutionDAO, Etherscan 0-day, MediaMarkt Ransomware, Robinhood Hack, and other Vulns Dec 03, 2021

Show notes

MediaMarkt was infected with Hive Ransomware preventing their cash registers from accepting credit cards. More than 5 million email addresses were stolen in a hack on Robinhood. A man threatened to burn down the Upbit Exchange. Blizzard Network was allegedly hacked by a malicious insider for $1 million. The ConstitutionDAO failed to purchase a copy of the US Constitution. Samczun created a CTF that included a 0-day in Etherscan.

Episode 47: AnubisDAO & Squid Game Rug Pulls, Malicious Browser Extensions, NFT Contract Vulns Nov 16, 2021

Show notes

In episode 47 we talked about two separate rug pulls that happened recently. Also, a number of fake Metamask and Phantom wallet extensions have been on the rise. We discussed potential vulnerabilities in smart contracts written for NFTs. BZX appeared to have a private key compromise resulting in the loss of over $53 million.

Show Notes at: https://coinsecpodcast.com/Episode-47-7e704784114442c1aef28d62ae6a96b2

Episode 46: Mudit Gupta Interview, Cream Finance Hacked Again, NFT Discord Hacks, 45 BTC Seized Nov 03, 2021

Show notes

In this episode we are joined by Mudit Gupta of SushiSwap to help break down the latest CREAM Finance hack. We explore how multiple Discord servers related to NFTs have been compromised recently. Police seized 48 BTC from a UK-based 16-year-old. We talk about how attackers are leveraging a custom administrative panel for phishing Coinbase credentials, including MFA. 3.1 million email addresses were leaked for users of CoinMarketCap. Facebook pushes for a metaverse and rebrands to "Meta".

Show Notes at: https://coinsecpodcast.com/Episode-46-562f5685ce6e490bafe66e8dbbbf1d4a

Episode 45: OpenSea Malicious NFTs, ETH 2.0 Front-Running attacks, Indexed Finance hacked & more Oct 27, 2021

Show notes

In this episode we talked about the largest crypto-related bug bounty payout ever. Compound accidentally sent millions in rewards due to a bug. StakeSteak left private keys on a Github repo resulting in compromise. A vulnerability was discovered in Rocketpool & Lido that would allow an ETH 2.0 node operator to perform front-running attacks against stakers. Indexed Finance, Pancake Hunny, and CreatureToadz all had security issues this week. We also discussed the potential for malicious NFTs and how they could be used to attack users on OpenSea.

Show Notes at: https://coinsecpodcast.com/Episode-45-6a8c7733f17b4cec8358ddeb92887a4f

00:00 - CoinSec Podcast Ep 45 – https://coinsecpodcast.com/Episode-45-6a8c7733f17b4cec8358ddeb92887a4f 01:23 - Story # 1: https://cointelegraph.com/news/crypto-market-cap-hits-new-all-time-high-as-btc-eth-soar 04:34 - Story # 2: https://decrypt.co/83997/polygon-dodges-850m-hack-pays-record-2m-bounty 11:38 - Story # 3: https://decrypt.co/82499/compound-exploit-drains-21m-from-lending-protocol 15:16 - Story # 4: https://stakesteak.medium.com/10-4-post-mortem-82edf38b0064 20:09 - Story # 5: https://medium.com/immunefi/rocketpool-lido-frontrunning-bug-fix-postmortem-e701f26d7971 24:30 - Story # 6: https://rekt.news/indexed-finance-rekt/ 41:57 - Story # 7: https://ownsnap.com/pancake-hunny-hunny-crashes-50-as-it-faces-token-leaks-in-pools/ 51:33 - Story # 8: https://thedrop.beehiiv.com/p/creature-toadz-hacked 55:58 - Story # 9: https://research.checkpoint.com/2021/check-point-research-prevents-theft-of-crypto-wallets-on-opensea-the-worlds-largest-nft-marketplace/

Episode 44: Bitcoin.org, pNetwork, and VeeFinance Hacks, Malicious Wallet, Compound Bug, & Puzzles Oct 06, 2021

Show notes

In episode 44 we talked about Bitcoin.org being compromised to redirect people to a scam. A Compound bug caused excess rewards to be sent out. pNetwork and VeeFinance were both hacked for millions of dollars. A malicious browser extension called Safepal was discussed. The largest bug bounty ever was paid equaling $1,050,000. We discussed an issue in SMS-based MFA resulting in theft from Coinbase users. Lastly, we talked about the many crypto-related puzzles currently available to participate in.

Show Notes at: https://coinsecpodcast.com/Episode-44-216ff3b62e21423c8be6e7134cca983b

00:00 - CoinSec Podcast 44 03:33 - Story # 1: https://decrypt.co/81612/bitcoin-org-compromised-fraudulent-crypto-giveaway-advertised 07:38 - Story # 2: https://twitter.com/dafthack/status/1439348515986104323?s=21 11:47 - Story # 3: https://www.rekt.news/overcompensated/ 19:22 - Story # 4: https://decrypt.co/81301/defi-bridging-protocol-pnetwork-suffers-12-million-hack 24:40 - Story # 5: https://rekt.news/veefinance-rekt/ 27:05 - Story # 6: https://www.bleepingcomputer.com/news/security/malicious-safepal-wallet-firefox-add-on-stole-cryptocurrency/ 32:15 - Story # 7: https://medium.com/immunefi/belt-finance-logic-error-bug-fix-postmortem-39308a158291 38:02 - Story # 8: https://twitter.com/electroneum/status/1440269750215479301?s=19 41:56 - Story # 9: https://www.bleepingcomputer.com/news/security/hackers-rob-thousands-of-coinbase-customers-using-mfa-flaw/ 49:09 - Crypto Puzzles!

Episode 43: MISO Supply Chain Hack, Gelato Front-Run, NowSwap & Zabu Hacks, Solana DoS & ETH Attack Sep 22, 2021

Show notes

In this episode we discuss one of the first major exploits on the Avalanche blockchain in Zabu Protocol. Some fake news surrounding Litecoin being accepted as payment at Wal-Mart was spread by major news outlets. An attack on Ethereum managed to trick some nodes into following a fake chain. Solana had a major denial-of-service issue. NowSwap was hacked resulting in the loss of over $1 million. Gelato had a front-running issue during its token sale. SushiSwap's token platform MISO was attacked via a supply chain attack.

Show Notes: https://coinsecpodcast.com/Episode-43-4bbec4a6843e4a279d3e42d9d45354e1

00:00 - CoinSec Podcast 43 03:41 - Story # 1: https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack/ 08:03 - Story # 2: https://hypebeast.com/2021/9/litecoin-walmart-partnership-rumors-surge-and-crash 12:20 - Story # 3: https://www.theblockcrypto.com/linked/117637/unsuccessful-attack-on-ethereum-managed-to-trick-a-few-nodes 15:24 - Story # 4: https://finance.yahoo.com/news/solana-mainnet-finally-back-online-121733288.html 23:28 - Story # 5: https://coingape.com/defi-hack-alert-nowswap-losses-over-1-million-in-cyber-attack/ 25:46 - Story # 6: https://stockhead.com.au/cryptocurrency/gelato-network-customers-out-in-the-cold-as-front-runners-snatch-about-us8m-in-tokens-for-us1-5m/ 32:54 - Story # 7: https://decrypt.co/81120/sushiswaps-token-launchpad-hacked-over-3m-ethereum 38:49 - Story # 8: https://github.com/LavaMoat/LavaMoat 44:27 - Story # 9: https://start.blockchainhax.com/

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected