What happened
On August 21, 2017, attackers compromised Enigma's public website, Slack community, and mailing-list communications ahead of its token sale. They impersonated the project and directed prospective contributors to send ETH to an attacker-controlled address. Contemporary reporting tracked 1,492 ETH, worth about $494,171 at the time; Enigma said its own company and investor funds were not compromised and later said it would help affected community members with claims.
How it happened
- Attackers obtained access to Enigma's landing-page and Slack-related accounts through compromised team credentials; reporting noted missing two-factor authentication as part of the account-security failure.
- They altered the public website, posted messages in Slack, and sent spoofed messages to the community mailing list.
- The messages promoted a fraudulent pre-sale and supplied an attacker-controlled ETH address, causing prospective contributors to transfer funds there.
- Enigma took its website and Slack community offline, moved updates to other channels, and announced stronger credential, two-factor-authentication, access-control, and compartmentalization measures.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
