DeFi

Squarespace Hacked – DeFi Wallets Emptied (Imaginary Money Stolen)

Published

6 months ago

16 July, 2024

Squarespace Hacked – DeFi Wallets Emptied (Imaginary Money Stolen)

Cryptocurrency fans are losing their worthless tokens via phishing attacks on decentralized finance sites.

Hundreds of domains on Squarespace have been made vulnerable by a gaping security hole: According to the researchers, NYSE:SQSP allowed anyone to claim and hijack any domain migrated from the now-defunct Google Domains service. Naturally, the attackers targeted cryptocurrency sites (since most of them are run by people who don’t know what they’re doing).

Yes, this is yet another story of weak DeFi security. Today SB Blogwatchnothing of value was lost.

Your humble blogger I have selected these blog posts for your entertainment. Not to mention: Metallica in Punjab.

Failure

What is happening ? Bill Toulas reports: DNS hijacking targets crypto platforms registered with Squarespace

“Attack on SquareSpace Accounts”
A wave of coordinated DNS hijacking attacks is targeting decentralized finance (DeFi) cryptocurrency domains using registrar Squarespace, redirecting visitors to phishing sites hosting wallet drainers. … Those who entered information on the phishing sites should take immediate action, … including revoking smart contract approvals, changing passwords, and transferring funds to a new wallet.
…
While the exact cause … has yet to be determined, the compromised domains were all originally registered to Google Domains, which were then forcibly transferred to Squarespace in 2023 as part of an asset purchase agreement with Google. … However, as part of the transition to Squarespace, Multi-factor authentication has been disabled.
…
Other Squarespace customers have also reported receiving suspicious password reset emails, which could indicate that this is part of a broader credential attack on SquareSpace accounts. [We] I have reached out to Squarespace for comment on the situation, but we are still awaiting a response.

What went wrong? samczsun, tayvano and AndrewMohawk know What went wrong?:

“Stealing the domain efficiently”
Contrary to early reports, the attacks were not caused by user negligence, such as reusing weak passwords or not enabling multi-factor authentication. … By default, Squarespace does not require email verification for new accounts created with a password. … As it stands, Squarespace is simply not a viable option for anyone [who] requires deeper control over their domains.
…
Squarespace never considered the possibility that a malicious actor could create an account using an email address associated with a recently migrated domain before the legitimate owner of the email address created the account themselves. Unfortunately, many domain contributors never created their Squarespace account, either because they forgot they had been granted contributor access or because they didn’t anticipate the security implications of inaction, making it relatively easy for a malicious actor to get ahead of them.
…
If you’ve gained unauthorized access to a Squarespace account [and] have “owner” permissions, you can simply transfer domain…thus stealing the domain itself. [Or]if you have “manager” permissions, you can … modify DNS records. … Having a Google Workspace administrator account allows the threat actor … to access historical emails, anything in Google Drive, Google Calendar, Google Docs, etc. [and] to turn to third-party services such as custody services or other financial accounts.

ELI5? dboreham explain as if we were five years old:

What [Squarespace] did: Put a billion DNS registration accounts in a state of limbo where anyone… could guess the email address associated with an account, could… obtain valid authentication information for the account, …without any verification that it came from the owner of the associated email address.

That he has done ? Ido Ben-Natan spoke to Sebastian Sinclair: Hundreds of DeFi Protocol Front-Ends Still Under Threat

“Inferno Drainer Group”
The incident…involved attackers targeting DNS records hosted on Squarespace. These records were redirected to IP addresses associated with known malicious activity [hosting] a page that drains funds from connected wallets.
…
“The association with Inferno Drainer is clear [from the] “We shared onchain and offchain infrastructure,” Ben-Natan said. “This includes onchain wallet and smart contract addresses as well as offchain IP addresses and domains related to Inferno.”
…
It works by tricking users into signing malicious transactions that give the attacker control over their digital assets. … The Inferno Drainer group has been active for some time, targeting various DeFi protocols and exploiting different vulnerabilities.

Ah, the curse of Google’s dead products. WillPostForFood it looks hungry:

It’s clear that Squarespace is the culprit here. But damn, I’m still pissed that Google shut down Domains, and I can’t help but direct some anger at them by abandoning another product.

RIP, Google Domains. Denis agrees:

It’s a shame that Google let us down in this endeavor. They’ve done it so many times before that I thought they’d learned their lesson.

I tried moving my domains from Squarespace after looking at their control panel. And it’s… a pain to migrate your domains.

However, this is not directly Google’s fault. Squarespace deserves most of the blame – and ecofeco is not surprised:

Having used Squarespace on several occasions on behalf of clients, I can say that it’s a patently crappy ecosystem, so I’m not surprised that it has some glaring holes.

Let’s not forget that the “victims” are imaginary money sites. As Retired chemist observes that this scene is in the Dunning-Kruger AF style:

Cryptocurrency companies. You would think they would be both security conscious and reasonably savvy on these topics. The real world never ceases to amaze me.

In the meantime, The prize for “best nominative determinism” goes to cynical security: [You’re fired—Ed.]

Squarespace spends a lot on marketing. They probably don’t have money to hire engineers anymore.

And finally:

Lars and James are die-hard fans

Previously in And finally

Have you readSB Blogwatch by Richi Jennings. Richi handpicks the best blog posts, forums, and weirdest websites, so you don’t have to. Hate mail can be sent to@RiCHi, @richij, @richi@vmst.io, @richi.bsky.social Or sbbw@richi.uk. Consult your physician before reading. Your mileage may vary. Past performance does not guarantee future results. Do not look into the laser with the remaining eye. E&OE. 30.

Image sauce: Creativity103 (cc:by; leveled and cropped)

DeFi

If You Missed BONK and PEPE This Year, This Viral New Crypto Might Be Your Salvation

Published

6 months ago

29 July, 2024

CoinFlix Staff

If You Missed BONK and PEPE This Year, This Viral New Crypto Might Be Your Salvation

Bonk and Pepe appear set to net new investors 10x to 100x returns over the next 12 months. However, cryptocurrencies in the DeFi play-to-earn gaming sector could offer even greater returns. As August approaches, Rollblock is emerging as a standout DeFi play-to-earn gem with the potential to 100x-1000x gains in the fourth quarter and beyond.

The project features an innovative revenue sharing model and exceptional accessibility, attracting players and investors. Additionally, Rollblock’s extensive game library of over 150 titles and enhanced sports betting are further driving excitement for the platform. Cryptocurrency analysts are expecting a sudden surge in demand. 800% a push for Rollblock from the beginning of September.

Bonk remains strong despite market fluctuations

While most well-known cryptocurrencies struggled throughout July, Bonk remained strong. As one of the highest-grossing meme cryptocurrencies of 2024, Bonk rose over 24% in July, while most cryptocurrencies experienced negative fluctuations.

Investors looking to add a relatively safe memecoin to their portfolio should consider Bonk. While Bonk is unlikely to generate explosive gains of 250x to 1,000x from here on out, Bonk could still theoretically provide returns in the 20x to 100x range.

Pepe should see a big rise in the next bull run

Alongside Bonk, Pepe has yet to go through a bull run. This means that there are still substantial gains to be made from Pepe over the next 12 months.

Pepe is down 4% in 30 days, but that shouldn’t worry Pepe investors in 2024. Experts believe Pepe’s best days are still ahead, with crypto analysts predicting a 10x to 50x surge in the next election cycle around November.

In the long term, Pepe could surpass the 100x mark for today’s investors. However, Pepe is a memecoin, and one should exercise caution when investing in purely speculative assets that have no utility.

Rollblock’s Unprecedented Hype Potential Could Push It Past 100x Valuation in Q4

Rollblock is a GambleFi Play-to-Earn token that integrates centralized and decentralized gambling on a single platform. By allowing players to earn rewards through active participation and gameplay, the platform creates a compelling incentive structure that appeals to both casual and competitive players.

With its cutting-edge blockchain technology, Rollblock offers top-notch security that keeps bets and transactions on the platform secure. The platform’s lack of KYC mandates appeals to both users who value anonymity and security.

Rollblock’s revenue sharing model, which allocates up to 30% of casino revenue to RBLK token holders, is a major draw for investors. The model involves burning half of the repurchased tokens and distributing the other half to stakers, increasing the token’s value and encouraging long-term investment.

The platform is also constantly evolving thanks to user feedback which has enabled updates such as the upcoming sports betting feature within the platform’s casino. This addition will complement Rollblock’s extensive game library of over 150 titles, ranging from traditional poker to innovative blockchain-based games.

RBLK is expected to emerge as one of the leading DeFi tokens in 2024. With a price of $0.0172 with impressive growth potential and over 140 million tokens sold recently, Rollblock is on track to enter the top 100 cryptocurrencies by Q4, making today a lucrative time to buy RBLK tokens.

Discover the exciting opportunities of the Rollblock (RBLK) presale today!

Website: https://presale.rollblock.io/

Social networks: https://linktr.ee/rollblockcasino

No spam, no lies, only insights. You can unsubscribe at any time.

Fuente

DeFi

Cryptocurrency sector is experiencing ‘most misjudged moment’ since 2020, says venture capitalist Arthur Cheong

Published

6 months ago

29 July, 2024

CoinFlix Staff

Cryptocurrency sector is experiencing ‘most misjudged moment’ since 2020, says venture capitalist Arthur Cheong

Veteran cryptocurrency investor Arthur Cheong believes the digital asset sector offers long-term holders a golden opportunity.

Cheong, the founder of DeFiance Capital, tell His 171,700 followers on social media platform X indicate that he believes decentralized finance (DeFi) is hugely undervalued.

According to Cheong, DeFi projects are innovating at a rapid pace and leaving traditional financial (TradFi) companies in the dust.

“It’s been a long time since I’ve been this excited about the risk/reward and potential upside of DeFi. This is probably the most misjudged moment since the pre-DeFi summer of 2020, with extremely promising prospects.

I see opportunities not only in OG (original) DeFi, but also in some newer projects that are evolving rapidly and growing at a pace that fintech startups will do anything to match.

The veteran investor also believes that crypto is now here to stay following recent launch from the Ethereum spot market (ETH) exchange-traded funds (ETFs) last week.

“Overall, the floodgates are open and there is no turning back. TradFi asset managers will continue to launch new crypto products because, guess what: there is huge demand for them!”

I expect them to launch actively managed crypto ETFs [in the] coming years. ”

Earlier this month, Cheong laid that it might be a bad strategy for cryptocurrencies to seek mass adoption, believing that digital assets are designed to disrupt several key financial sectors.

“I think we should accept that cryptocurrencies may not be suited for mass adoption like Web2, but rather are optimized for some narrow but very high-impact use cases like stateless global money, cross-border payments, and decentralized finance.

Chasing mass adoption of normies may be chasing the wrong Grail from the start.

Don’t miss a thing – Subscribe to receive email alerts directly to your inbox

Check Price action

follow us on X, Facebook And Telegram

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed on The Daily Hodl are not investment advice. Investors should do their own due diligence before making any high-risk investments in Bitcoin, cryptocurrencies or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Featured image: Shutterstock/ktsdesign