'$300m in cryptocurrency' accidentally lost forever due to bug
'$300m in cryptocurrency' accidentally lost forever due to
bug
User mistakenly takes control of hundreds of wallets
containing cryptocurrency Ether, destroying them in a panic while trying to
give them back
‘We are analysing the situation and will release an
update with further details shortly, Parity told users.
By Alex Hern Wednesday
8 November 2017 06.29 EST Last modified on Wednesday 8 November 2017 09.25 EST
More than $300m of cryptocurrency has been lost after a
series of bugs in a popular digital wallet service led one curious developer to
accidentally take control of and then lock up the funds, according to reports.
Unlike most cryptocurrency hacks, however, the money
wasn’t deliberately taken: it was effectively destroyed by accident. The lost
money was in the form of Ether, the tradable currency that fuels the Ethereum
distributed app platform, and was kept in digital multi-signature wallets built
by a developer called Parity. These wallets require more than one user to enter
their key before funds can be transferred.
On Tuesday Parity revealed that, while fixing a bug that
let hackers steal $32m out of few multi-signature wallets, it had inadvertently
left a second flaw in its systems that allowed one user to become the sole
owner of every single multi-signature wallet.
The user, “devops199”, triggered the flaw apparently by
accident. When they realised what they had done, they attempted to undo the
damage by deleting the code which had transferred ownership of the funds.
Rather than returning the money, however, that simply locked all the funds in
those multisignature wallets permanently, with no way to access them.
“This means that currently no funds can be moved out of
the multi-sig wallets,” Parity says in a security advisory.
Effectively, a user accidentally stole hundreds of wallets
simultaneously, and then set them on fire in a panic while trying to give them
back.
“We are analysing the situation and will release an
update with further details shortly,” Parity told users.
Hard fork
Some are pushing for a “hard fork” of Ethereum, which
would undo the damage by effectively asking 51% of the currency’s users to
agree to pretend that it had never happened in the first place. That would
require a change to the code that controls ethereum, and then that change to be
adopted by the majority of the user base. The risk is that some of the
community refuses to accept the change, resulting in a split into two parallel
groups.
Such an act isn’t unheard of: another hack, two years
ago, of an Ethereum app called the DAO resulted in $150m being stolen. The hard
fork was successful then, but the money stolen represented a much larger
portion of the entire Ethereum market than the $300m lost to Parity.
The lost $300m follows the discovery of bug in July that
led to the theft of $32m in ether from just three multisignature wallets. A
marathon coding and hacking effort was required to secure another $208m against
theft. Patching that bug led to the flaw in Parity’s system that devops199
triggered by accident.
Parity says that it is unable to confirm the actual
amount lost, but that the $300m figure is “purely speculative”. The company
also disputes that the currency is “lost”, arguing that “frozen” is more
accurate. But if it is frozen, it appears that no-one has the ability to
unfreeze the funds.
“The Parity vulnerability was the result of an
incorrectly coded smart contract used by the Parity wallet to store tokens on
the Ethereum network,” said Dominic Williams, founder of blockchain firm
DFINITY. “The vulnerability made it possible for anyone to ‘freeze’ the tokens
held by that smart contract, making them immovable. At this time, the only
method we are aware of to ‘unfreeze’ tokens held by the vulnerable smart
contract would be to create a new ‘hard fork’ Ethereum client that deploys a
fix. This would require every full node on the Ethereum network to upgrade by
the date of the hard fork to stay in sync, including all miners, wallets,
exchanges, etc.”
Ethereum has rapidly become the second most important
cryptocurrency, after Bitcoin, with its price increasing more than 2,500% over
the past year. One token of Ether is now worth a little over $285, up from $8
in January.
Comments
Post a Comment