Unibot Encounters Hacker Attack: How Should Telegram Users Protect Their Assets?

11/03/2023·1years ago

The well-known Telegram trading tool Unibot has become the latest victim in a series of expanding cryptocurrency attack incidents.

Unibot admitted to being attacked on October 31st due to a token approval vulnerability in the new router. Unibot's official announcement stated, "A token approval vulnerability has appeared in the new router, and Unibot has temporarily suspended the new router to address this issue. Any financial losses caused by the new router's error will be compensated; users' keys and wallets are safe and a detailed response will be issued after the investigation." It is reported that this vulnerability resulted in a loss of over $630,000. In this article, veDAO Research Institute will bring the specific details of this incident and provide advice on how to protect your assets on Telegram.

On October 31st, blockchain analysis company Scopescan notified Unibot users that the platform was undergoing an ongoing but undetected attack, and a vulnerability in a newly deployed contract on Unibot led to the clearing of multiple users' cryptocurrency balances.

Subsequently, Unibot released the announcement mentioned at the beginning of the article, revealing the initial details of the hacker attack and confirming that it was due to a token approval vulnerability in the new router.

Scopescan urged users to revoke approval for the exploited contract (0x126c9FbaB3A2FCA24eDfd17322E71a5e36E91865) and transfer funds to a new wallet to cooperate with Unibot and blockchain investigators' ongoing investigation.

Unibot promised to compensate all users for financial losses caused by the contract vulnerability. The attack began at 12:39:23 on October 31st and lasted until 14:09:47 on the same day. During this period, the attacker executed 22 attack transactions, transferring a total of 42 types of tokens from 364 victim addresses through the router to the attacker's hands. The exploiter then sold these tokens, obtaining a total of 355.5 ETH. Currently, all 355.5 ETH has been transferred to Tornado.Cash. According to weekly transaction statistics, these include cryptocurrencies such as Joe (JOE), UNIBOT, and BeerusCat (BCAT).

UNIBOT Plummets Nearly 40%

Although Unibot has promised to compensate for the losses, UNIBOT has still experienced a sharp decline due to the impact of the hacker news. According to CoinMarketCap data, UNIBOT plummeted from $58.34 to a low of $35.94 after the incident, with a maximum drop of 38%, followed by a slight rebound to hover around $42. It is worth noting that despite strong panic selling, whales and smart money took the opportunity to buy a large amount of UNIBOT.

Follow-up

On November 1st, Unibot announced on Telegram that the vulnerability from the previous day had been completely resolved and had reverted to the old router; Unibot is currently safe and operating normally. However, the return of assets to affected users will take some time: Unibot is currently conducting the final few rounds of simulations, intending to ensure the complete return of users' tokens through additional measures. The announcement stated that due to the variety of tokens affected by the vulnerability, the refund process will take longer than expected. As these tokens differ in scale and liquidity, the refund will ultimately be in the form of a mix of different tokens + ETH.

Unibot is a trading tool bot built into Telegram, allowing users to complete on-chain token trading activities on Uniswap in the form of a conversation with the bot on Telegram, such as token exchange, copy trading, limit orders, and private transactions. Unibot is popular on Telegram for its user-friendly interface. In short, Unibot allows users to switch between different tokens without leaving the chat app. However, users can also use MEV to protect transactions and replicate other traders' trading strategies. The native token of this app soared to an astonishing $236 in mid-August, demonstrating its popularity.

Learn more about Unibot details:

https://app.vedao.com/projects/11af33a7c6ee5c9bae19219a682f7a0749779794c4a8ffdee61c16f7d2939b4b

Telegram Bots

In addition to Unibot, there are many other Telegram bots, such as Mizar, Banana Gun, Maestro, and Wagie Bot, which have many users. Telegram bots are automated programs that run through the Telegram chat program. They can trade, provide market data to users, evaluate sentiment on social media, and interact with smart contracts through commands initiated via the Telegram interface. This type of bot has been around for many years, but in recent years, they have gained attention with the emergence of Telegram bot tokens.

Telegram bot tokens are native tokens integrated into Telegram bots, mainly used for a variety of trading functions, such as executing DEX trades, managing investment portfolios across wallets, liquidity mining, and other DeFi-related operations. Essentially, these tokens allow users to access the entire DeFi ecosystem through interaction with the Telegram interface.

Since the end of July, the popularity of these tokens has risen sharply, with some tokens seeing gains of over 1000%. Especially after the emergence of Unibot, a large number of Telegram bot tokens have emerged. Currently, CoinMarketCap lists 73 Telegram bot tokens.

Unibot's vulnerability this time means that its smart contract has permission flaws, which may lead to users' tokens being moved beyond specified limits or unauthorized access, causing concern.

Before transferring the stolen assets to Tornado.Cash, the attacker first transferred them to the decentralized exchange Uniswap. In the crypto world, Tornado.Cash often becomes the center of attention for notable hacker attacks and exploit vulnerabilities. Several members of the protocol's development team were accused in August of assisting in money laundering, involving an amount exceeding $1 billion, including from North Korean enterprises. Compared to before the arrests and subsequent penalties, the number of people using this privacy protocol has decreased by 90%.

In the week before Unibot was attacked, some LastPass users reported losing $4.4 million in cryptocurrency. Security experts pointed out that this may be due to a LastPass vulnerability in December last year, although frequent vulnerabilities in the past ten months have left many people confused as they seem to have no pattern.

Another major weakness in the cryptocurrency field is the cross-chain bridges that allow users to transfer assets between incompatible networks. The lending platform Exactly, which relies on Optimism, was stolen in August, resulting in a loss of $7 million. The Ronin cross-chain bridge of Axie Infinity was exploited in March 2022, causing a loss of approximately $622 million; in addition, there was also a vulnerability event in the Wormhole cryptocurrency platform, from which hackers stole an astonishing $320 million.

These events constantly remind people that these security issues are unavoidable challenges as cryptocurrency continues to develop into the mainstream market.

Telegram has become one of the most commonly used messaging programs in the cryptocurrency community. Every major blockchain project and cryptocurrency community has a Telegram account, where they create channels and groups to encourage interaction and community building. The widespread use of Telegram makes it a valuable tool for cryptocurrency enthusiasts to learn more information and discuss their favorite projects, but it also attracts the attention of hackers.

Let's review the common cryptocurrency scams on Telegram and how to protect your assets:

Phishing and Message Scams

On Telegram, phishing takes the form of "Smishing" (SMS phishing). Its purpose is to extract sensitive data, usually targeting high-profile individuals with "whale" or "spear phishing" attacks.

Phishing scams on Telegram typically involve sending messages to as many people as possible. More often, they target "spear phishing" and "whaling" to extract sensitive data, used to target organizations and high-profile individuals.

Off-Platform Scams

These scams lure users off the platform and into clicking links, potentially tricking users into sharing personal information or downloading malicious software.

Impersonation Scams

Scammers create fake Telegram channels or groups that mimic real channels, making users believe they are part of the genuine community. You can verify the authenticity of a channel by enabling "admins only" to post in settings and restricting who can add you to the channel.

Impersonating Cryptocurrency Experts

Scammers on Telegram impersonate cryptocurrency experts and promise to increase your earnings. They often disappear immediately after collecting users' login information.

Pump and Dump Schemes

These scams promote events that may impact prices, urging users to invest or sell. Be cautious when receiving investment advice from strangers in private messages.

Telegram Bots

While Telegram bots can be useful, some hackers create fake bots. Avoid bots that urge you to take action, check their phone numbers, and the content they post, and never share sensitive information.

Technical Support Scams

Scammers impersonate support personnel in Telegram channels. Do not share confidential information with so-called support personnel, whether they are bots or real people.

Fake Giveaways

Be wary of those asking for your bank details or requiring you to pay a fee to receive a prize, as these are likely scams.

Since Telegram encompasses almost all cryptocurrency projects and has numerous communities, scammers see it as an attractive platform. Therefore, it is crucial to avoid leaking personal information, making payments, or clicking suspicious links.

veDAO is a web3 trend tracking and intelligent trading platform driven by AI, combining market trend data analysis with trading depth to create a more suitable web3 AI exchange for Web2 and Web3 users to buy, sell, and invest.

veDAO has a leading AI language model composed of on-chain analysis and sentiment indicators, providing proactive data support to users, combined with intelligent, fast, secure, real-time monitoring AI trading functions. As of now, the platform has over 37,000 heavily engaged users, is associated with 22,000+ Web3 vertical industry Twitter KOLs, and has a veDAO expert committee consisting of 180+ professional institutions, with a project library of over 8300+ and 220+ scouts continuously adding Web3 projects with veDAO.

veDAO is committed to continuous upgrades at a bi-weekly update pace, determined to build a bridge from Web2 to Web3 and become the preferred platform for Web2 and Web3 users to search for projects, find hotspots, view trends, and make primary investments and secondary trades.

Website: http://www.vedao.com/

Twitter: https://twitter.com/vedao_official

Facebook: bit.ly/3jmSJwN

Telegram: t.me/veDAO_zh

Discord: https://discord.gg/NEmEyrWfjV

🔴Investment carries risks, projects are for reference only, please bear the risks on your own🔴