Shalini Nagarajan

<div id="highlights-block_634d2dcfbb9e2" class="highlights">
        <ul>
                <li>Hack amounted to 4% of TempleDAO’s assets</li>
                <li>Tornado Cash is a sanctioned entity in the US, meaning individuals there are prohibited from dealing with the mixer</li>
            </ul>
    
</div>



<p>A hacker who exploited DeFi protocol TempleDAO used sanctioned crypto mixer Tornado Cash to move their stolen funds.</p>



<p>Earlier this month, the yield-farming protocol was <a href="https://cms.blockworks.co/templedao-loses-2-million-in-latest-exploit/" target="_blank" rel="noreferrer noopener">exploited</a> for 1,831 ETH (around $2.34 million). All funds were moved to a <a href="https://etherscan.io/address/0x2b63d4a3b2db8acbb2671ea7b16993077f1db5a0" target="_blank" rel="noreferrer noopener">new wallet</a>. </p>



<p><a href="https://etherscan.io/address/0x2b63d4a3b2db8acbb2671ea7b16993077f1db5a0" target="_blank" rel="noreferrer noopener">Etherscan data</a> shows about the same amount of ether was transferred from the hacker’s identified address to a Tornado Cash router on Sunday. The move will obfuscate the destination of the stolen funds. The protocol’s immutable smart contracts are capable of providing privacy for criminals as well as lawful users.</p>



<p>Blockchain investigator PeckShield first <a href="https://twitter.com/peckshield/status/1581627065924694021?t=BH6lEyp9hP8xwiPz2cUe_Q&amp;s=19" target="_blank" rel="noreferrer noopener">noted</a> the exploiter’s use of the crypto mixer.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">The <a href="https://twitter.com/templedao?ref_src=twsrc%5Etfw">@templedao</a> exploiter is starting to move funds via <a href="https://twitter.com/TornadoCash?ref_src=twsrc%5Etfw">@TornadoCash</a>   <a href="https://t.co/UOl3RJjExq">https://t.co/UOl3RJjExq</a> <a href="https://t.co/SReMSq573P">pic.twitter.com/SReMSq573P</a></p>&mdash; PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1581627065924694021?ref_src=twsrc%5Etfw">October 16, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>The transfers began with 0.1 ether, followed within minutes by multiple other transactions worth 100 ether each.</p>



<p>Tornado Cash acts as a cryptoasset mixer, making it extremely difficult to trace precisely the origin of funds withdrawn. It was added to the US Treasury’s <a href="https://cms.blockworks.co/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash/" target="_blank" rel="noreferrer noopener">sanctioned list</a> of “Specially Designated Individuals” in August, prohibiting people in the country from dealing with the service. </p>



<p>The Treasury’s primary <a href="https://home.treasury.gov/news/press-releases/jy0916" target="_blank" rel="noreferrer noopener">concern</a> was the mixer’s role in laundering over $455 million worth of cryptoassets stolen by the North Korean hacking group Lazarus. </p>



<p>Before TempleDAO’s exploit, the protocol’s total value locked stood at about $57 million, according to DeFiLlama. The attack amounted to about 4% of its assets. Security firm BlockSec said the <a href="https://twitter.com/BlockSecTeam/status/1579843881893769222" target="_blank" rel="noreferrer noopener">root cause</a> behind it was insufficient access control to a specific function in the affiliated Stax Finance smart contract. </p>



<h3 class="wp-block-heading">October marks the highest value of crypto hacked all year</h3>



<p>October has so far turned out to be a <a href="https://cms.blockworks.co/october-already-record-month-for-hacks-and-exploits/" target="_blank" rel="noreferrer noopener">record month</a> for hacking activity, with stolen funds amounting to $718 million across 11 different DeFi protocols, according to Chainalysis.</p>



<p>The $100 million exploit of <a href="https://cms.blockworks.co/binance-pauses-trading-of-native-token/" target="_blank" rel="noreferrer noopener">Binance’s BNB chain</a> and the $112 million <a href="https://cms.blockworks.co/mango-markets-exploit-plot-revealed/" target="_blank" rel="noreferrer noopener">extracted from Mango Markets</a> took place in the last two weeks  — and the month is only half over.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


BlockSec

TempleDAO Hacked Funds Deposited to Tornado Cash

Bessie Liu

<div id="highlights-block_634591a4a10b8" class="highlights">
        <ul>
                <li>An estimated 1.1 million TEMPLE was sold off</li>
                <li>The root cause of the exploit was insufficient access control to the migrateStake function, according to BlockSec</li>
            </ul>
    
</div>



<p>TempleDAO, a yield-farming DeFi protocol, has been <a href="https://twitter.com/PeckShieldAlert/status/1579842411907362816" target="_blank" rel="noreferrer noopener">exploited</a> for around $2.34 million.</p>



<p>All funds exploited were <a href="https://twitter.com/PeckShieldAlert/status/1579842411907362816" target="_blank" rel="noreferrer noopener">converted</a> to ether and then moved to <a href="https://etherscan.io/address/0x2b63d4a3b2db8acbb2671ea7b16993077f1db5a0" target="_blank" rel="noreferrer noopener">a new wallet</a>, where they now sit.&nbsp;</p>



<p>The pseudonymous Doc Peppercorn, a contributor to TempleDAO, posted on its Discord group that a series of transactions through Stax Finance, a TempleDAO-affiliated dapp, led to the sell-off of an estimated 1.1 million TEMPLE, the primary token of the Temple Protocol.</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p><strong>“We are investigating what happened so we can bring you the full picture of how this occurred, what we did to resolve and any further remediation steps,” he wrote.</strong></p></blockquote>



<p>The root cause of the exploit was insufficient access control to a specific function in the Stax smart contract, <a href="https://twitter.com/BlockSecTeam/status/1579843881893769222" target="_blank" rel="noreferrer noopener">according to</a> security firm BlockSec.</p>



<p>Prior to the exploit, TempleDAO’s protocol’s total value locked was about $57 million, <a href="https://defillama.com/protocol/temple-dao" target="_blank" rel="noreferrer noopener">according to DeFiLlama</a>. The exploit amounted to roughly 4% of the protocol’s assets.&nbsp;</p>



<p>According to a recent <a href="https://assets.ctfassets.net/t3wqy70tc3bv/6tpOiGqBr1VXs0AsnLwo1Y/33f0eb2e2a911d645bad874dad2ca73e/Immunefi_Crypto_Losses_in_Q3_2022_Report.pdf" target="_blank" rel="noreferrer noopener">report</a> published by bug bounty and security services platform, Immunefi, DeFi protocols remain a key target for exploits in comparison to centralized finance — representing a total of 98.8% of losses in Q3 of 2022 — with the <a href="https://cms.blockworks.co/nomad-recovers-nearly-20m-of-stolen-190m/" target="_blank" rel="noreferrer noopener">Nomad Bridge hack</a> and the <a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">Wintermute exploit</a> making up the majority of the losses.</p>



<p>The two most targeted chains were Binance’s BNB Chain, which was recently <a href="https://cms.blockworks.co/after-bnb-chain-hack-operators-must-face-question-of-decentralization/" target="_blank" rel="noreferrer noopener">drained of over 2 million BNB,</a> and Ethereum, according to the report.</p>



<p>At the time when the report was published, the BNB Chain had suffered from 16 individual attacks resulting in the loss of 28.6% of all losses across targeted chains, and Ethereum reported 13 incidents which represented 23.2% of total losses.</p>



<p>The exploiter’s address was originally funded from an address on the Binance Exchange, so it’s possible the exchange may have know-your-customer information on the culprit.</p>



<p>A Binance spokesperson did not immediately respond to a request for comment.</p>



<p>Stax Finance is exploring its options.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">We are following up with Binance and will initialize a white hat bounty for the exploiter. We are increasing our existing bounty with Hats Finance and establishing secure communications if the hacker chooses to return funds and receive a legal bounty. Details to come.</p>&mdash; STAX (@staxfinance) <a href="https://twitter.com/staxfinance/status/1579855205512130561?ref_src=twsrc%5Etfw">October 11, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Temple DAO <a href="https://twitter.com/templedao/status/1579878591981969416" target="_blank" rel="noreferrer noopener">said</a> that its Core Vaults do not share code with Stax and are therefore unaffected.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


TempleDAO

Newsletter

Blockworks Research