What exactly happened in the Slope finance hack?

by Sven Hugo
· 5 minute read

It took a hacker(s) only four hours to steal 9,231 Slope wallets of SOL and other crypto worth about $4.1 million. A day later, the vulnerability was traced to Slope finance, a Solana wallet provider, where hackers gained access to client passwords and so too their wallets. 

The hack wasn’t the largest by any means, but it was the ease of access to client information that had many scratching their heads. All the attackers had to do was find the key that unlocked the backdoor to Slope’s servers. It didn’t even take much computer systems know-how to get in. 

Below is how the Slope finance hack unfolded.

2 August 2022

22:37 UTC time, a Tuesday. As Solana users started noticing their funds disappearing from their wallets and posting about it on Twitter, the rumour mill quickly kicked into gear. Has the Solana blockchain been compromised? Was the issue with Phantom, a Solana wallet provider? Or was it with another Solana wallet provider, Slope? Was the entire Solana ecosystem at risk? Why were only some hot wallets, those connected to the internet, affected and not others? Why not hard wallets and those at centralised exchanges?

In the early hours of the day, 3 August, a tweet came from the Solana camp. “Engineers from multiple ecosystems, with the help of several security firms, are investigating drained wallets on Solana. There is no evidence hardware wallets are impacted. This thread will be updated as new information becomes available.” 

“We are working closely with other teams to get to the bottom of a reported vulnerability in the Solana ecosystem,” tweeted Phantom, another Solana wallet provider. “At this time, the team does not believe this is a Phantom-specific issue.

What people think happened

Anatoly Yakovenko, the cofounder of Slope, first raised the possibility of a “supply chain attack,” where the hackers could have gained access to Slope’s wallets through a bug in another services provider’s technology, possibly at Apple. 

There was a flood of uncertainty and untested theories at this stage, but most security analysts, who were either hired by the affected companies or internet vigilantes, agreed that the best thing to do was for owners of the affected wallets to immediately move their coins offline to a hardware wallet or a wallet at a centralised exchange, both seemingly unaffected by the hack. 

“Wallets drained should be treated as compromised, and abandoned,” Solana tweeted. 

Slope, the Solana wallet provider, who was becoming the most likely culprit for the data breach, also released their first official statement: 

“Here is what we know at this juncture regarding the breaches to our user base:

  • A cohort of Slope wallets were compromised in the breach
  • We have some hypotheses as to the nature of the breach, but nothing is yet firm
  • We feel the community’s pain, and we were not immune. Many of our own staff and founders’ wallets were drained.”

To this, the internet did not have kind words. And it wasn’t long after that Slope was confirmed as the vector of the attack, which had nothing to do with the Solana blockchain despite various media outlets reporting it initially as a “Solana hack”. 

What actually happened 

What initially threw investigators off the scent was the emptying of Slope wallets and Phantom wallets, two entirely different wallet providers, which pointed to a possible system-wide Solana breach. But this was easily explained when it all came to light. 

The hacker(s) gained entry to the Slope server where, due to a bug in the code, user passwords were being automatically stored. The hackers somehow became aware, or were made aware, of this treasure chest of passwords belonging to Slope clients who happened to use the same passwords for their Phantom wallets. 

The technical explanation from Ottersec, a blockchain auditing firm who had been hired by Slope, was as follows: 

“We have independently confirmed that Slope’s mobile app sends off mnemonics via TLS to their centralized Sentry server. These mnemonics are then stored in plaintext, meaning anybody with access to Sentry could access user private keys.” 

In plain English, this means that client passwords were erroneously sent to a server where a hacker, or anyone for that matter, had access to it. 

“On-chain transactions show that private keys for the affected wallets had been leaked or compromised, and were used to sign malicious transactions,” was the official and latest finding from Solana. 

Quick take

What’s a hot wallet?

A hot wallet is a cryptocurrency wallet that is always connected to the internet. Web-based and mobile phone wallets are hot wallets. Generally, these wallets are easier and more convenient to use for sending and trading crypto, but they are more vulnerable to online attacks, as hackers can get access to your wallet through your phone or computer. 

And a cold wallet? 

A hardware wallet, for example, is a cold wallet, seeing that it’s not connected to the internet, meaning that there’s no way a hacker can get access to your crypto other than physically getting hold of your device and/or seed phrase. Many exchanges, including Luno, also store the majority of their clients’ crypto in cold wallets, also referred to as cold storage. 

Slope offered a 10% bounty offer for the safe return of the coins, with the idea of returning the SOL to its clients. 

“We ask the attacker to return 90% of the stolen funds within 48 hours of 8h30pm UTC Augstu 5, 2022. Upon receipt of these funds, we will not make additional efforts to investigate this matter, or pursue any legal action,” Slope said. 

The call went unanswered. 

A conclusion 

“The auditors’ investigations are nearing their conclusion, and we feel it’s now appropriate to provide regular updates,” Slope said on 11 August. 

The company confirmed again what already had been communicated by the auditing firms and other people on Twitter. 

Solana again made the point that it was an isolated breach. “No core code related to Solana Labs, the Solana Foundation, or anything related to Solana protocol itself was involved in this attack. This was not a protocol-level vulnerability,” the company said. 

Phantom said on 9 August that the team has not found any evidence that its systems were compromised during the attack. “While some Phantom users were affected, in each case we have reviewed, we found that they had imported their seed phrases/private keys to or from a non-Phantom wallet,” the company explained. 

As for Slope, they have yet to find “conclusive” evidence to link the vulnerability to the exploit, the company said, but added that the very existence of said vulnerability put a lot of assets in danger. “We should never have let this happen,” the company said. The first sentence leaves a lot to interpretation. 

Could it mean that someone gained access to the server and the passwords without even knowing about the bug? A full post-mortem is currently underway and all will be told once this is done, says Slope. 

Did you find this useful?

24
5