Incident Overview
On the 10th of May, a security breach led to an unauthorized withdrawal from our hot and warm wallet, the following are the withdrawn amounts and the respective destination addresses and transaction IDs:
1. 17gPdCyzEMRXdNTBpHrUhsM4FaiWMHhx2Q
cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf
2. 1PWQJu9AskoXEBYMod1KqPE6TTG4VYNz1P
85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9
3. 1Mu1wbyfkcrRarPveiihy5iuceLGC91Z4T
33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64
4. 1MeY3VVudFUV91gxVZsaY92TguRWy7eQbE
90239779a08243883f54bdb2503f4f40be2541487c2ef2383ef4d8277660e88b
5. LV8VnCDYJzd3FYNwn6n3Kyi1i7PB2MvXPo
30231aee25900b9cb1fba16f1a8923a0cd866d60b01e542be1a4b26f92d9d10f
The total losses of the security breach are:
1454 BTC
225,263 TRC
23,400 LTC
The attacker has acquired login credentials to the Vircurex VPS control account with their hosting service provider and has then asked for the root password reset of all servers which – unfortunately – the service provider has then done and posted the credentials in their helpdesk ticket, rather than the standard process of sending it to Vircurex email address (which had 2FA protection), also the security setup of allowing only Vircurex IP range to login to the management console was not working. It was an additional security feature the provider offered but was obviously circumvented by the attacker.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Vircurex, these are the critical security checks that could have prevented this incident (May 2013).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Vircurex
The Vircurex hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.