Orbit Chain Attacked: Losses Up to $80 Million

At the beginning of the New Year 2024, a major security incident has drawn widespread attention in the cryptocurrency community. According to a security risk monitoring platform, the Orbit Chain project suffered a severe attack, with losses amounting to at least 80 million USD. Security analysis revealed that the attackers had begun small-scale probing attacks a day earlier and used stolen ETH as fuel for the subsequent large-scale attack.

Orbit Chain, as a cross-chain bridge platform, allows users to utilize various crypto assets across different blockchains. In response to this security incident, the project team has taken emergency measures, suspending the operation of the cross-chain bridge contract and attempting to establish communication with the attackers.

Attack Analysis

The core of this incident lies in the fact that the attacker directly called the withdraw function in the Orbit Chain bridging contract, successfully transferring a large amount of assets. A deeper analysis of the code structure of the withdraw function reveals that this function employs a signature verification mechanism to ensure the legitimacy of the fund transfer.

In blockchain transactions, signature verification is a common and important security measure used to confirm the identity and authority of the transaction initiator. The withdraw function aims to ensure that only authorized entities can perform asset transfer operations by verifying signatures.

Further research into the signature verification function _validate reveals that this function returns the number of owner signatures. This number is then compared to a preset threshold to determine whether to allow the transaction to proceed. According to on-chain data, this contract has a total of 10 administrator addresses, and the required value is set to 7, meaning that at least 70% of the administrators need to sign off to approve asset withdrawals.

Attack Process

The actions of the attackers can be traced back to December 30, 2023. Since then, the attackers have begun a series of small-scale probing attacks and have distributed small amounts of stolen ETH to several other addresses in preparation for a subsequent large-scale attack.

The real large-scale attack occurred on the evening of December 31, 2023. The attackers exploited multiple addresses to simultaneously launch attacks on various crypto assets of the Orbit Chain project, including DAI, WBTC, ETH, USDC, and USDT.

Capital Flow

As of now, the transfer situation of the stolen funds has become initially clear. After officially launching the attack, the attackers dispersed the stolen funds into five different addresses. These transactions include:

• 50 million stablecoins (30 million USDT, 10 million DAI, and 10 million USDC)
• 231 wBTC (valued at approximately 10 million USD)
• 9500 ETH (worth approximately 21.5 million USD)

Security Insights

This incident once again emphasizes the importance of security in blockchain systems. When designing and implementing blockchain projects, security should always be a primary consideration.

1. Code Security: Contract code, as the core of the blockchain system, must adhere to the strictest security standards and best practices to avoid common vulnerabilities and attack vectors.

2. Authentication: A robust authentication mechanism, multi-signature, and permission management system are key to preventing unauthorized access and asset loss.

3. Continuous Monitoring: It is crucial to monitor system anomalies in real-time and respond quickly to potential threats.

4. Risk Diversification: Implement a multi-layered security strategy to avoid single points of failure.

5. Security Audit: Conduct regular comprehensive security audits to promptly identify and fix potential vulnerabilities.

This incident reminds us that while pursuing innovation and efficiency, we must not overlook the importance of fundamental security measures. Only by establishing a comprehensive and stringent security system can we provide users with truly safe and reliable blockchain services.