BitKeep Wallet Suffers $1M Hack After Attacker Exploits Swap Feature

let atwWrapper,atwContainerWidth,atwSliderBox,atwTotalWidth; function initATWSlider() { atwWrapper = $('.relatedInstruments'); atwSliderBox = atwWrapper.find('.slider'); atwContainerWidth = atwWrapper.width(); atwTotalWidth = atwSliderBox.width(); if(window.domainId === '2' || window.domainId === '3'){ atwWrapper.find('.sliderRight').addClass('js-slider-prev'); atwWrapper.find('.sliderLeft').addClass('js-slider-next'); } else { atwWrapper.find('.sliderRight').addClass('js-slider-next'); atwWrapper.find('.sliderLeft').addClass('js-slider-prev'); } if(atwSliderBox.find('.instrumentBox').length > 6){ atwWrapper.find('.js-slider-next').fadeIn(600); } } function atwMoveRight() { atwWrapper.find('.js-slider-prev').fadeIn(150); $(".slider > :visible:first").hide(150) $(".slider > :visible:last").next().show(150); if(!$(".slider > :visible:last").next().find('.name')()){ atwWrapper.find('.js-slider-next').fadeOut(150); return; } } function atwMoveLeft() { atwWrapper.find('.js-slider-next').fadeIn(150); $(".slider > :visible:last").hide(150); $(".slider > :visible:first").prev().show(150); if(!$(".slider > :visible:first").prev().find('.name')()){ atwWrapper.find('.js-slider-prev').fadeOut(150); return; } } initATWSlider(); //update star icon on adding/removing instrument to/from specific watchlist atwWrapper.on('click', 'label.addRow', function() { let parent = $(this).parent(); let checkedPortfolio = false; parent.find('input[type=checkbox]').each(function () { if($(this).is(':checked')){ checkedPortfolio = true; } }); let closestStar = $(this).closest('.addToPortWrapper').find('.star'); if(checkedPortfolio){ closestStar.addClass('added'); }else{ closestStar.removeClass('added'); } }); //update star icon on creating new watchlist atwWrapper.find('.js-create-watchlist-portfolio').find('a.js-create').on('click',function () { let parent = $(this).parent(); let watchlistName = parent.find('input[type=text]').val(); if(!watchlistName){ return; } let star = $(this).closest('.addToPortWrapper').find('.star'); star.addClass('added'); }); //update star icon on adding new position atwWrapper.find('.js-create-holdings-portfolio').find('.js-submit').on('click',function () { let addPositionForm = $(this).closest('.addToPortfolioPop').find('.holdingsContent'); let amount = addPositionForm.find('.js-amount').val(); if(amount < 1){ return; } let star = $(this).closest('.addToPortWrapper').find('.star'); star.addClass('added'); }); atwWrapper.find('.instrumentBox').find('.shortInfo').on('click',function () { if(!window.ga){ return; } let pairId = $(this).parent().find('.js-add-to-portfolio').attr('data-pair-id'); let pairType = window.atwPairTypes[pairId]; window.ga('allSitesTracker.send', 'event', 'content', 'symbol link clicked', '', { "dimension147":"symbol_link_clicked", "dimension163":"click", "dimension148":"symbol", "dimension162":"content add to watchlist", "dimension161":"article page", "dimension142":"article", "dimension75":pairType, "dimension138":pairId, "dimension118":"2916383" }); window.open($(this).attr('data-href')); }); window.atwPairTypes = {"1058142":"currency"};

Multichain crypto wallet BitKeep has suffered a $1 million hack after an anonymous exploit of its swap feature on the BNB Chain.

Blockchain security company PeckShield was the first to report the hack, and recommended that users employ the ‘Revoke’ tool to halt any token allowances and avoid further damages.

The attacker has since transferred the stolen funds through Tornado Cash, an Ethereum-based, privacy focused fund mixer that was recently sanctioned by the U.S. government.

BitKeep has confirmed the attack, but revealed that they were able to stop the attacker by disabling the swap feature. The firm’s next steps wil be to “communicate and cooperate with major security agencies to track down the hackers and do our best to recover the stolen assets”.

BitKeep has also published a plan for reimbursing the victims, stating that it will launch a compensation portal within three working days. Affected users will be able to apply for a 100% refund.

The team behind the crypto wallet has also launched a wallet safety assurance feature, along with a one-tap repair feature.

BitKeep is one of the most popular crypto wallets on the market, boasting more than 6 million users worldwide, with most of its customer base residing in Asia.

Hacking Spree Continues

BitKeep joins the almost one dozen crypto projects that have been hacked during the month of October. According to Chainalysis, hackers have stolen more than $718 million in the first two weeks alone, which is enough to make October the most profitable month for crypto hackers.

Four attacks took place in an inauspicious event on October 11th, the worst of which took place on Mango Markets, a Solana-based decentralized protocol, as it was drained of $114 million after a hacker manipulated its token.

The hacker, who doxed himself as Avraham Eisenberg on Twitter, has since returned $67 million to the protocol, but kept $47 million as a bounty reward–one of the largest such rewards in crypto history.

Another victim was TempleDAO, a yield-farming DeFi protocol built on Ethereum, which lost over $2 million due to some technical discrepancies in the protocol.

Layer-1 blockchain QANplatform followed suit, suffering a bridge hack that resulted in the theft of more than $1 million. Hackers also attacked the Ethereum-based wallet service Rabby, which saw its Rabby Swap feature exploited and around $200,000 drained.

Prior to these attacks, Binance Chain (BNB) had also suffered a major hack. The event saw the perpetrator make away with an approximate $100 million worth of tokens after exploiting the BSC Token Hub—a cross-chain bridge between the BNB Smart Chain and the BNB Beacon Chain.

On the Flipside

• It’s unclear how the hacker was able to carry out the exploit.
• The refunds promised by BitKeep will not be automatic, and users will first be required to apply through a compensation portal to be considered.

Why You Should Care

The BitKeep exploit is just one of the dozen hacks that have occurred in October. Users should double-check if their funds are safe wherever they’re holding them.

You might also like:

Mango Markets (MNGO) Initiates a Vote to Reimburse Victims of $114M Exploit

DeFi Hack Season Continues as TempleDAO (TEMPLE) and Mango Markets (MNGO) Lose over $100M

See original on DailyCoin