Li.Fi protocol attacked, $10M drained
The Li.Fi protocol experienced a security breach when hackers exploited a specific contract address, resulting in the loss of over $8 million in cryptocurrencies. The attack has since been mitigated.
Li.Fi, an API for Ethereum Virtual Machine and Solana swaps and bridging, was attacked on July 16, and over $10 million in cryptocurrencies was drained.
According to Cyvers, the team’s systems alerted to suspicious transactions on Li.Fi involving a specific contract address.
Cyvers recommended users revoke their approvals for the suspected address: 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae
Speaking with Cointelegraph, Meir Dolev, co-founder and chief technology officer at Cyvers, explained that protocols must be vigilant:
“Hackers can exploit these approvals to drain both assets stored in the contracts and funds in the connected wallets of users.”
Get to know Godleak
Godleak crypto signal is a service which provide profitable crypto and forex signals. Godleak tried to provide you signals of best crypto channels in the world.
It means that you don’t need to buy individual crypto signal vip channels that have expensive prices. We bought all for you and provide you the signals with bot on telegram without even a second of delay.
Godleak crypto leak service have multiple advantages in comparision with other services:
- Providing signal of +160 best crypto vip channels in the world
- Using high tech bot to forward signals
- Without even a second of delay
- Joining in +160 separated channels on telegram
- 1 month, 3 months , 6 months and yearly plans
- Also we have trial to test our services before you pay for anything
For joining Godleak and get more information about us only need to follow godleak bot on telegram and can have access to our free vip channels. click on link bellow and press start button to see all features
Join for Free
☟☟☟☟☟
https://t.me/Godleakbot
Also you can check the list of available vip signal channels in the bot. by pressing Channels button.
Li.Fi warning
In an X post on July 16, Li.Fi warned its community that users should not interact with Li.Fi-powered applications until further notice.
When the attack was underway, the team explained that it was investigating the exploit and clarified that users who “did not set infinite approval” were not at risk.
For users who manually set infinite approvals, the Li.Fi team stated that the following addresses should be revoked:
- 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae
- 0x341e94069f53234fE6DabeF707aD424830525715
- 0xDE1E598b81620773454588B85D6b5D4eEC32573e
- 0x24ca98fB6972F5eE05f0dB00595c7f68D9FaFd68
At 11:44 am ET (15:44 UTC), Li.Fi updated its users in an X post that the smart contract vulnerability had been mitigated. “There is currently no further risk to users,” the post stated. “The only wallets affected were set to infinite approvals, and represented only a very small number of users.”
$10 million drained
According to Cyvers, approximately $10 million in cryptocurrency holdings were drained, which also affected the Arbitrum blockchain.
Dolev told Cointelegraph that “this incident underscores the risks inherent in granting wallet approvals to smart contracts.”
In an X post updating the community on the situation, Cyvers again recommended users revoke the 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae address to prevent further losses.
From drains to flash loan attacks
Decentralized finance protocol Dough Finance was also recently under attack on July 12, becoming the victim of a $1.8 million flash loan attack.
Cyvers reported on the incident, explaining that the attacker funded the attack through the zero-knowledge protocol Railgun and swapped the stolen USD Coin
USDC for Ether (ETH).
According to Web3 security provider Olympix, the exploit, which accrued 608 ETH and is valued at around $1.8 million, resulted from unvalidated call data with the “ConnectorDeleverageParaswap.”
