Hugh Karp, founder of the DeFi mutual-insurance project Nexus Mutual, having lost more than $8 million in the hack, described the incident in detail and gave recommendations to users.
A post-mortem and status update on the NXM hack from last week.
Thanks to everyone for their messages of support, and specifically to those that have been helping out our investigations.https://t.co/cCFsoP9WTD
— Hugh Karp 🐢 (@HughKarp) December 21, 2020
Karp used a Ledger hardware wallet connected to the Nexus Mutual app via the MetaMask extension on a Windows computer. He said that on December 11, while composing an email, the screen went dark for two to three seconds.
“Everything returned to normal, and I simply assumed something strange happened and carried on,” said the project's CEO.
An hour later the attacker replaced MetaMask with a malicious version. On December 14, the founder of Nexus Mutual decided to claim a mining reward — the extension displayed the standard pop-up requesting confirmation. Karp did not verify the address and confirmed the transaction. He discovered the substitution only after consulting the Etherscan blockchain explorer.
“This attack showed that it is necessary to check all transactions, regardless of their size,” said Karp.
In his view, the hacker prepared the transaction in advance, having stolen 370,000 native NXM tokens (about $8.22 million at the time), rather than all available assets. The private keys in the Ledger wallet were not compromised.
The Nexus Mutual CEO described the MetaMask wallet as an “obvious target” for many attackers. He recommended the community use separate devices for signing transactions and spread assets across different storage locations.
Also, Karp reached out to the attack organizer with a proposal to channel their skills in the right direction and join the “white hat” community.
Earlier in December, the attacker demanded from Nexus Mutual’s founder a ransom of 4,500 ETH.
Subscribe to ForkLog news on Telegram: ForkLog FEED — all the news feed, ForkLog — the most important news and polls.