How a DeFi power user got hacked for $24M
Dear Bankless Nation,
Losing money in crypto sucks.
And losing a lot of money in a hack has got to be one the worst things that can happen to a crypto native on the bankless journey. Once crypto leaves your wallet, it’s gone.
There’s no customer support in the frontier of finance.
(We told you the journey isn’t for everyone.)
But the risk comes with the territory. Crypto systems are decentralized and immutable. For the good and the bad—ownership transfers can’t be undone.
I shared this yesterday…but when I learned about Hugh’s hack my big question was—if this could happen to a DeFi protocol founder… are any of us safe?
We had to find out what happened. To see if we could learn from it. To see if we’re vulnerable. And here’s the awesome part…Hugh was completely open to sharing the story in hopes that it would help the community level up its security. 🙏
There’s a lesson here. First, this community is awesome, and we’re all better when we hitch our wagons and level up together. Second, while you’re vulnerable to this type of attack, it can also be prevented…if you follow the steps in the post.
Our condolences to Hugh—this is a terrible loss. But he’s given us a tremendous gift. Because he’s willing to share, we get to learn. We get to level up our security measures so we can minimize our risk of this happening again.
Here’s the story of the $24m attack on Hugh Karp (the Karp attack) and the lessons we can learn from it.
I recommend you watch the 20 min video, then read this post.
- RSA
WRITER WEDNESDAY
How a DeFi Power User Got Hacked for $24M+
Watch the video then read this post.
Summary of the Karp Attack
On December 14th, 2020, Hugh Karp, the founder of Nexus Mutual—a decentralized mutual providing discretionary cover on smart contracts (aka insurance)—was sabotaged and swindled into signing a malicious transaction on Metamask.
He was using a hardware wallet. 🤯
The result was 370,000 NXM (currently valued at $24M+) sent to a hacker’s address. The exploiter instantly liquidated the majority of the NXM into ETH/BTC and dispersed it across the crypto ecosystem to different addresses and exchanges.
All funds were lost and unrecoverable.
This attack should be seen as a case study on how even crypto power users (like you?) can fall for these attacks. We’ll also dive into how to protect yourself from similar exploits and share security practices to minimize your risk.
Event Recap
It was just another Monday for Hugh Karp, the founder of Nexus Mutual.
He received an email on a subject relevant to the work he was doing for the Mutual at the time. The attachment was a Microsoft Word doc—nothing out of the ordinary—so he opened it.
When Hugh opened the .docx file, it was embedded with a second malicious file that exposed a vulnerability in the Microsoft operating system. Once opened, the hacker effectively had remote access to Hugh’s computer. His primary device for working in crypto was now compromised.
After some time, the hacker remotely switched the Chrome browser into developer mode and altered the default Metamask extension. The hacker created an exact clone of Metamask, except with a key difference—this version of Metamask came spring-loaded with code that would steal Hugh’s funds.
The next time Hugh would go to sign a transaction with his Ledger, the malicious Metamask clone would instead display a different transaction—a transaction that would send funds to an address the hacker controlled.
While the details of this transaction displayed on the Ledger address, they were obscured in hex code. And who among verifies the hex code before they approve a Ledger transaction?
When Hugh approved the transaction, which he thought was to claim some yield farming rewards, the transaction instead sent a large amount of NXM to exploiter. The rest is history. The hacker immediately wrapped the NXM and transferred those funds into ETH & BTC and dispersed the money throughout the crypto ecosystem.
All funds were lost.
How to protect yourself from this type of attack
It’s crazy to think that even the biggest DeFi power users can fall prey to these attacks.
Hugh was one of the first public victims of this exploit—he took the first bullet. Fortunately for the rest of us, we can learn a lot from what happened.
While it’s important to remember that no security system is 100% foolproof, we can take these measure to protect ourselves from something similar in the future.
Here’s what Hugh did to prevent another hack in the future.
Immediate Next Steps:
- Threw out his computer. The computer was still compromised.
- Switched operating systems. The attack happened via Windows OS, meaning that it could happen on another Windows laptop. This doesn’t mean that other operating systems are invulnerable, but it does lower the risk of it happening again as the hacker would have to design a similar exploit for a new OS.
Basic Security Habits
- Getting into the habit of matching the contract address on Ledger & Etherscan. Technically, had Hugh done this, the hack would have been preventable. Truth is, most active Ethereum users are not verifying the contract address they’re interacting with, with the one that’s on the tiny Ledger screen. But getting in the habit of doing this could actually save you a fortune one day.
- Looked into other hardware wallets with bigger screens. The screen on current Ledgers are pretty small, making it a bit more annoying to do all the verification mentioned above. There are new wallets coming out with better UI—Hugh mentions the Lattice—which could make it easier to view outgoing transactions!
- Don’t feel rushed about making a transaction, it’s more important to be slow and secure. Take your time with signing transactions! Doing the above steps of verifying the contract address you’re interacting with, with the one that’s on your Ledger, and the Metamask browser can be cumbersome. Yes, it’s be annoying. We get it! But it’s a crucial step for those who are handling lots of money, and signing lots of transactions.
Advanced Security Habits
- Purchased a dedicated computer for signing transactions. This is one of the most foolproof ways someone can use to protect themselves. Having a dedicated computer where usage is minimal, and only to a handful of websites (like Uniswap), is the ultimate way to minimize your security risks. Even if your main computer is compromised because you’re going to a million websites a day and opening tons of files, your assets are safe as no transactions are being signed via the more vulnerable device. (A dedicated computer takes more work, but may be worth it if you’re dealing with large sums)
Key Learnings
Here’s a few key takeaways for anyone using crypto:
- This attack can be done to anyone. You don’t have to be a DeFi founder or a public figure to be a target. All you need is enough money to make it worth stealing. No one is invulnerable.
- This stuff is only going to be more prevalent. This attack happened via email but could happen through Discord—leaving thousands of individuals at risk through their more-public Discord handles. Be careful!
- The industry needs to provide more digestible data. We need to replace long hex codes with human readable information. You should know you’re interacting with the USDC contract when you are, rather than having to match it with the hex code on Etherscan.
- Multisigs are the future of optimal security. If Hugh had been using a multisig, the hacker would have to had compromised multiple devices in order to execute the transaction. The only problem? Using in multisig in DeFi isn’t a great time.
- A different wallet could have helped. A hardware wallet with more human readable transaction details would have helped in this case. A smart contract wallet like Argent can also provide protection from these types of exploits.
How to help out
First off, we’re sincerely sorry for Hugh Karp for having to deal with this. Losing your money in crypto is not fun. It sucks a lot.
But we also need to thank him—he took this bullet for the crypto industry. As bystanders, we get to learn from this exploit. We can use this attack as a case study on how to improve our security practices.
From Hugh’s perspective, the biggest thing the Ethereum community can do to help is to continue to fund public goods. Whether it’s giving builders the tools to create better products or more usable interfaces (like for multisigs), the funding that goes into these small projects can help move the needle for the broader Ethereum ecosystem.
Security is painful. Yes, it can be annoying. Yes, it takes time.
But it’s worth it.
We hope this story serves as a valuable resource for those looking to improve their crypto security systems.
Action steps
- Consider what extra steps you can do to improve your crypto security
- Watch the Post Mortem with Hugh Karp
- Consider wallets like the Lattice or Argent that protect against this