The CoinSec Podcast

Latest Episodes:

Episode 42: Track Transactions With BitQuery, MEV Protections, DAOMaker Hack, & Token Sniffer Sep 15, 2021

Show notes

In this episode of the CoinSec Podcast Steve Borosh (@424f424f) show how to track transactions using BitQuery. We talk about Miner Exctractable Value (MEV) and some potential protection mechanisms. DAOMaker was hacked for a 2nd time. Mastercard acquired CipherTrace. A contract analysis tool called TokenSniffer was discussed as well.

Episode 41: CREAM, Bilaxy, & X-Token Hacks, PancakeSwap Prediction Bot, & A Blockchain Hacking Guide Sep 07, 2021

Show notes

C.R.E.A.M. v1 market on Ethereum suffered an exploit draining $18.8 million. Bilaxy Exchange was hacked for $21 million. X-Token's xSNX smart contract was exploited with an estimate $4.5 million lost. Banksy was warned about a vulnerability in website prior to exploitation resulting in NFT scam. Steve shows off his PancakeSwap market prediction bot. Beau shows a new Blockchain Hacking QuickStart Guide he created at https://start.blockchainhax.com.

00:00 - CoinSec Podcast Ep 41 : https://coinsecpodcast.com/Episode-41-2f0413737fef4ba5833e9f246162bf70 04:07 - Story # 1: https://twitter.com/electroneum/status/1431620290967216131 09:53 - Story # 2: https://cointelegraph.com/news/cream-finance-defi-platform-loses-19m-in-a-flash-loan-hack 17:07 - Story # 3: https://cointelegraph.com/news/bilaxy-exchange-suspends-website-after-erc-20-hot-wallet-hack 19:44 - Story # 4: https://www.rekt.news/xtoken-rekt-x2/ 25:21 - Story # 5: https://www.bbc.com/news/technology-58437753 32:01 - LINK: Carnac https://github.com/rvrsh3ll/Carnac 41:32 - BlockchainHAX QuickStart Guide: https://start.blockchainhax.com/ 44:32 - Getting Started in Blockchain Security & Smart Contract Auditing: https://register.gotowebinar.com/register/3816384386435465995 Honk Kong by Taseh is licensed under a Attribution-NonCommercial-ShareAlike License. Based on a work at https://taseh.bandcamp.com/

Episode 40: Geth Vuln Causes Eth Fork, Poly Hack Update, Antinalysis, OpenZeppelin Vuln & Rug Pulls Aug 31, 2021

Show notes

Geth version 1.10.7 and older has a vulnerability currently being exploited that split Ethereum's chain. Poly Network has announced that they have regained control of all stolen funds. Potential rug pull in Luna Yield protocol. Maze Protocol hack investigation update. Antinalysis Bitcoin tracing tool. Big tech companies to spend billions on cybersecurity. A vulnerability was patched in an OpenZeppelin library.

Show Notes: https://coinsecpodcast.com/Episode-40-214c586a59434780bbc2d325649bf86f

00:00 - CoinSec Podcast Episode 40 01:05 - LINK: https://coinsecpodcast.com/Episode-40-214c586a59434780bbc2d325649bf86f 01:26 - Story # 1: https://www.bleepingcomputer.com/news/security/ethereum-urges-go-devs-to-fix-severe-chain-split-vulnerability/ 09:54 - Story # 2: https://medium.com/poly-network/poly-network-asset-recovery-complete-a7ba33c2f2e4 12:31 - Story # 3: https://www.coindesk.com/markets/2021/08/20/solanas-luna-yield-goes-dark-with-some-fearing-a-rug-pull-involving-67m/ 17:56 - Story # 4: https://blog.mazeprotocol.com/an-aftermath-update-a1ee7b24468c 20:49 - Story # 5: https://decrypt.co/79331/dark-web-tool-dirty-bitcoin-returns-after-shutdown?utm_source=twitter&utm_medium=social&utm_campaign=auto 25:28 - Story # 6: https://www.cnbc.com/2021/08/25/google-microsoft-plan-to-spend-billions-on-cybersecurity-after-meeting-with-biden.html 35:47 - Story # 7: https://twitter.com/OpenZeppelin/status/1430999829748932614 42:58 - Story # 8: https://decrypt.co/79459/brazilian-police-carry-out-record-cryptocurrency-seizure?utm_source=twitter&utm_medium=social&utm_campaign=auto 47:24 - Story # 9: https://twitter.com/kelvinfichter/status/1430951568505978888

Honk Kong by Taseh is licensed under a Attribution-NonCommercial-ShareAlike License. Based on a work at https://taseh.bandcamp.com/

Episode 39: SushiSwap Fix Vuln, Liquid Global Hack, Ransomware Bribes & a Flash Loan Exploit Demo Aug 24, 2021

Show notes

In episode 39 we discuss how SushiSwap was able to fix an issue in their MISO auction potentially saving $350 million in funds. Japanese exchange Liquid Global was hacked for close to $90 million. Some cybercrime groups are offering $1 million in Bitcoin to target employees to deploy ransomware on their networks. Finally, we demonstrate an example smart contract exploit against a flash loan lending pool. Show Notes: https://coinsecpodcast.com/Episode-39-1fcad93d5e60429b9f6a2cd68ea78327 00:00 - CoinSec Podcast Ep 39 01:51 - LINK CoinSecPodcast.com 02:13 - Story # 1: https://decrypt.co/78802/ethereum-dex-avoids-350m-defi-hack-thanks-white-hat-heroics 08:01 - Story # 2: https://cointelegraph.com/news/breaking-liquid-exchange-hacked-to-the-tune-of-80-million 15:16 - Story # 3: https://thehackernews.com/2021/08/cybercrime-group-asking-insiders-for.html 20:46 - Story # 4: https://docs.google.com/document/d/1-WoQwT1QrPEX-r4N-fDamRQ50LM8DsdsOyq1iTabS3Q/edit 28:51 - Story # 5: https://decrypt.co/78715/crypto-exchanges-see-10x-increase-phishing-attacks-says-new-report?utm_source=twitter&utm_medium=social&utm_campaign=auto 33:34 - Story # 6: https://blog.mazeprotocol.com/neko-hacking-incident-report-e46cdf179fd9 36:41 - Mobile Apps coming to Windows 11 : https://www.cnet.com/tech/computing/android-apps-on-windows-11-yup-how-it-works-which-apps-you-get-when-to-download/ 41:09 - https://cryptozombies.io/ 43:26 - Exploit Demo Honk Kong by Taseh is licensed under a Attribution-NonCommercial-ShareAlike License. Based on a work at https://taseh.bandcamp.com/

Episode 38: Poly Network Hack, Popsicle Finance Hack, DAO Maker Hack, and the Infrastructure Bill Aug 16, 2021

Show notes

CoinSec is back after a lengthy hiatus. Much has happened in the crypto space since the last episode. In this episode we discuss the largest DeFi hack ever along with two other hacks that resulted in large financial loss. Also, we discuss the looming infrastructure bill and potential concerns around crypto.

00:00 - CoinSec Episode 38 02:49 - Story # 1: https://decrypt.co/78163/polynetwork-suffers-record-breaking-600-3m-hack 03:13 - LINK: coinsecpodcast.com 25:36 - Story # 2: https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million 28:02 - Story # 3: https://cointelegraph.com/news/dao-maker-crowdfunding-platform-loses-7m-in-latest-defi-exploit?utm_content=buffer1b294&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer 34:08 - Story # 4: https://www.cnbc.com/2021/08/09/senate-rejects-compromise-crypto-tax-amendment-to-infrastructure-bill.html 39:17 - Bug Bounty Programs: https://docs.pancakeswap.finance/code/bug-bounty

Show Notes: https://coinsecpodcast.com/Episode-38

Honk Kong by Taseh is licensed under a Attribution-NonCommercial-ShareAlike License. Based on a work at https://taseh.bandcamp.com/

Episode 4: Smart Contract Security Issues, Coincheck Hack, NIST Guidance on Blockchain, Coinhive in Google Ads, and WannaMine Feb 02, 2018

Show notes

On this episode Mike Felch (@ustayready) details some of the critical vulnerabilities that can be introduced into Ethereum smart contracts. The largest cryptocurrency hack ever happened to Coincheck. Coinhive made it's way into Google ads, and a new malware called WannaMine is using the NSA Eternal Blue exploit to compromise more hosts to mine on. Also, NIST put out guidance on Blockchain & cryptocurrency.

Episode 3: Intro to Mining, Sia ASICs, VeChain DRP Plan, Hacken, and North Korea Hacking South Korean Exchanges Jan 25, 2018

Show notes

Steve Borosh (@424f424f) gives an introduction to mining cryptocurrencies. The hosts chat about the idea of splitting up private keys in different physical locations. News items for the week included VeChain's first ever cryptocurrency disaster recovery plan, reports of North Korea hacking South Korean exchanges, Sia ASIC miner drama, and discussion around millions being stolen from ICO's every month. Lastly the group chats about the penetration testing and bug bounty token Hacken.io.

Episode 2: Chris Gates (carnal0wnage), Blackwallet Hack, Lisk Vuln, and Cryptocurrency Mining Malware Jan 19, 2018

Show notes

This episode welcomes Chris Gates (AKA carnal0wnage) to the show to discuss how he got into cryptocurrency, and his new cryptocurrency project "The Great Altcoin Chase" (www.thegreataltcoinchase.com). Oracle WebLogic servers were being exploited to mine Monero, and Checkpoint states that Coinhive was the most prevalent malware of December, 2017. The Stellar Lumens wallet Blackwallet.co was DNS hijacked, and a vulnerability related to hijacking Lisk accounts was discussed.

Episode 1: Intro to CoinSec! Jan 10, 2018

Show notes

In this inaugural episode of the CoinSec Podcast each host provided a brief history of their involvement in the InfoSec industry, and how they each got into cryptocurrency. Discussions were had around the latest vulnerabilities in the crypto space. Critical Electrum & Parity wallet vulns were discovered. Overstock.com had a critical vulnerability specifically related to Bitcoin payments. Also discussed was how malware authors are moving away from Bitcoin to Monero as a form of payment. The hosts did a deep dive into the PolySwarm ICO. Lastly, for those new to cryptocurrency a discussion around getting started with various exchanges was had.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected