NEAR протоколунун Rainbow Bridge чабуулчусу 2.5 ETH жоготту

On May 1, the NEAR Protocol Rainbow Bridge was attacked. The cross-chain bridge had temporarily been suspended for maintenance after detecting abnormal activities.

Кененирээк кызмат, Alex Shevchenko, CEO of Aurora Labs, revealed that the attack was stopped automatically as the bridge architecture was designed to resist such events. No funds were lost during the event, Shevchenko added.

Чабуул

It all started when the attacker sent some ETH through the popular coin mixer, Tornado Cash, on May 1. They deployed a contract meant to deposit some funds to become a valid Rainbow Bridge relayer.

The main intention was to send “fabricated” light client blocks. According to Shevchenko, the bridge watchdogs identified that the block submitted was not in the NEAR blockchain and, in turn, created a “challenge transaction” and sent it to Ethereum.

After the watchdog transaction failed, MEV bots figured that front-running it would result in a 2.5 ETH gain. The exec explained,

“As a result, watchdog transaction failed, MEV bot transaction succeeded and rolled back the fabricated block of the attacker. Some min after this, our relayer submitted a new block. A bit later we started to investigate the strange behavior and paused all the connectors. And once figured out the details, unpaused them back.”

He then revealed that the attack was mitigated fully automatically, and the users continued their transactions in both directions. Shevchenko also noted that the NEAR protocol will take additional measures to ensure the cost of an attack attempt is increased – meaning – the stake for the relayer is expected to rise manyfold, so similar endeavors would cost much more. The focus should be on security and robustness, explained the CEO.

"Блокчейнде инновацияларды киргизип жаткан ар бир адамга колдо болгон бардык каражаттар: автоматтык системалар, эскертмелер, мүчүлүштүктөр, ички жана тышкы аудиттер аркылуу өз продукциясынын коопсуздугуна жана бекемдигине жетиштүү көңүл буруусун каалайм."

DeFi Bridge Attacks

In recent months, blockchain bridges have become prime targets for attacks. In one of the biggest heists in the history of cryptocurrency, attackers башкарылган to steal $620 million worth of Ethereum and USDC stablecoin from Axie Infinity’s Ronin Network after targetting Ronin Bridge, which allows users to move funds between the network and Ethereum.

Earlier this year, Qubit Bridge lost $80 million worth of cryptocurrency, while Wormhole Bridge lost $320 million just weeks later.