Insider work? Chainalysis Report Reveals MultiChain Attacker Had Insider Ties

On July 6, 2023, the Multichain protocol was hit by a major hack that resulted in the loss of over $125 million worth of cryptocurrencies. The attack targeted the protocol’s Phantom Bridge, resulting in the theft of valuable crypto assets such as WBTC, USDC, DAI, wETH, and LINK.

The amount stolen was an astonishing $126 million, with WBTC contributing $30.9 million, wETH $13.6 million and USDC $57 million. The exploit is one of the biggest crypto hacks on record.

Multichain Attacks and Insider Threats

according to a recent news reports By analysis and data company Chainalysis, the attack is suspected to be an insider job as Multichain has recently experienced some notable issues unrelated to its protocol design, leading the public to suspect that insiders carried out this recent exploit. Will have given

The disappearance of Multichain’s CEO, known as Zhaojun, and the subsequent suspension of services for more than 10 chains including Dinochain, Redlight Chain, and Public Mint have added to this suspicion.

Multichain’s smart contracts are secured by a multi-party computation (MPC) system, which functions similarly to a multi-signature wallet system. However, like multi-signature wallets, these systems are still vulnerable if an attacker has enough MPC keys.

It is possible that the attacker gained control of the MPC keys of MultiChain in order to execute this exploit. Interestingly, the attacker did not swap centrally controlled assets like USDC, which can be frozen by the issuing company (Circle, in the case of USDC), with the addresses holding those assets.

Most hackers are usually looking to quickly swap funds for people who are not vulnerable to those security measures. In total, the addresses frozen by Circle and Tether account for approximately $65 million in assets stolen from MultiChain.

What’s next for Protocol?

Following the attack, the Multichain team tweeted that they were launching an investigation and urged users to stop trading. A day later, on 7 July, the team tweeted that the service would be suspended indefinitely as per protocol.

Unfortunately, the scammers spread a “phishing” link on Twitter and posed as the Phantom Foundation to claim “emergency FTM distribution” to affected users.

Cross-chain bridge protocols have proven attractive targets for hackers due to their experimental designs and the fact that they typically have large, centralized repositories of assets bridged by users to other blockchains. However, there are several ways you can mitigate the risk and prevent similar exploits from happening.

According to Chainalysis, one way to help developers standardize projects and investors to evaluate protocol feasibility is through rigorous code audits.

While it appears that multichain hacks have been caused by compromised keys rather than faulty code, reputable audit reports often clearly identify which parts of the protocol are vulnerable to private key theft, giving users a better understanding of the risk. can help with the assessment. Additionally, users of any protocol can do research before transacting.

This exploit has perplexed the blockchain community, with many waiting for an official statement from the Multichain team. The team has not made any public announcements on the matter, leaving users and investors in the dark about the future of the protocol.

Multichain’s native token, MULTI, has experienced a significant decline over the past 7 days, down by over 27% over this time frame. Currently, the coin is trading at $2.387, showing a further decline of 3% in the last 24 hours.

Featured Image from Unsplash, Chart from Tradingview.com