On May 1, the NEAR Protocol Rainbow Bridge was attacked. The cross-chain bridge had temporarily been suspended for maintenance after detecting abnormal activities. In a detailed post, Alex Shevchenko, CEO of Aurora Labs, revealed that the attack was stopped automatically as the bridge architecture was designed to resist such events. No funds were lost during the event, Shevchenko added. The Attack It all started when the attacker sent some ETH through the popular coin mixer, Tornado Cash, on May 1. They deployed a contract meant to deposit some funds to become a valid Rainbow Bridge relayer. The main intention was to send “fabricated” light client blocks. According to Shevchenko, the bridge watchdogs identified that the block submitted was not in the NEAR blockchain and,
Topics:
Chayanika Deka considers the following as important: AA News, DeFi News, Hacking, Near Protocol (NEAR), social
This could be interesting, too:
Chayanika Deka writes Investors Fret Over Interest Rates: Digital Asset Outflows Hit 6M
Martin Young writes Grayscale’s Mini-Bitcoin ETF to Have Lowest Fees on The Market
Andrew Throuvalas writes Copying Crypto? New York Stock Exchange May Enable 24/7 Trading
Wayne Jones writes Bitcoin Layer 2 Tokens Outperform BTC Post-Halving
On May 1, the NEAR Protocol Rainbow Bridge was attacked. The cross-chain bridge had temporarily been suspended for maintenance after detecting abnormal activities.
In a detailed post, Alex Shevchenko, CEO of Aurora Labs, revealed that the attack was stopped automatically as the bridge architecture was designed to resist such events. No funds were lost during the event, Shevchenko added.
The Attack
It all started when the attacker sent some ETH through the popular coin mixer, Tornado Cash, on May 1. They deployed a contract meant to deposit some funds to become a valid Rainbow Bridge relayer.
The main intention was to send “fabricated” light client blocks. According to Shevchenko, the bridge watchdogs identified that the block submitted was not in the NEAR blockchain and, in turn, created a “challenge transaction” and sent it to Ethereum.
After the watchdog transaction failed, MEV bots figured that front-running it would result in a 2.5 ETH gain. The exec explained,
“As a result, watchdog transaction failed, MEV bot transaction succeeded and rolled back the fabricated block of the attacker. Some min after this, our relayer submitted a new block. A bit later we started to investigate the strange behavior and paused all the connectors. And once figured out the details, unpaused them back.”
He then revealed that the attack was mitigated fully automatically, and the users continued their transactions in both directions. Shevchenko also noted that the NEAR protocol will take additional measures to ensure the cost of an attack attempt is increased – meaning – the stake for the relayer is expected to rise manyfold, so similar endeavors would cost much more. The focus should be on security and robustness, explained the CEO.
“I wish everyone who is innovating in the blockchain to pay enough attention to security and robustness of their products through all the available means: automatic systems, notifications, bug bounties, internal and external audits.”
DeFi Bridge Attacks
In recent months, blockchain bridges have become prime targets for attacks. In one of the biggest heists in the history of cryptocurrency, attackers managed to steal $620 million worth of Ethereum and USDC stablecoin from Axie Infinity’s Ronin Network after targetting Ronin Bridge, which allows users to move funds between the network and Ethereum.
Earlier this year, Qubit Bridge lost $80 million worth of cryptocurrency, while Wormhole Bridge lost $320 million just weeks later.