What happened
On July 26, 2024, the Casper Network team found that an attacker had used a protocol bug to move tokens out of 13 accounts. Casper's preliminary report puts the illicit transfers at about $6.7 million. The root cause was found around 13:00 UTC that day.
Some validators paused consensus at about 07:50 UTC on July 27 while a patch was built. Before restart, Casper scanned the chain from genesis and found no earlier use of the bug. The fix shipped as a network upgrade that patched the access-control logic, wrote changes directly to global state to remove the attacker's access, and removed blocks 3,329,417 and 3,329,418.
That orphaned four transactions: three native transfers totaling 2,023,040 CSPR and one NFT mint. The network resumed on July 31, 2024. The Casper Association said it expected to recover much of the money and that affected parties would get their CSPR back, with a reimbursement process for any shortfall.
How it happened
- Casper uses URefs (unforgeable references) with access rights to control who can read, write or add to resources such as token purses.
- A bug in contract installation let a contract installer skip the access-rights check on URefs.
- The attacker installed contracts that granted themselves access to URef-based resources belonging to other accounts.
- With that access, the attacker transferred tokens out of 13 accounts, about $6.7 million in total.
- Validators paused consensus, and an upgrade patched the check, removed the attacker's access through a global-state write, and dropped the last two blocks.
Protocol details
Evidence
- report Casper Blockchain Security Update: Preliminary Incident Report casper.network
- analysis DeFiLlama defillama.com
- analysis Casper Security Update on the July 26th Breach casper.network
- analysis Casper Network AMA Recap | Aug. 2nd 2024 casper.network
- analysis Casper Network halts operations following security breach cointelegraph.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
