Hackers Steal $119M from ‘Web3’ Crypto Project with Old School Attack

vice.com

26 pointsgz53 comments

> it appears someone injected a malicious script into BadgerDAO’s frontend after compromising an API key for BadgerDAO’s Cloudflare account

This looks like a Badger failure, otherwise we’d hear about a lot more problems with Cloudflare. If Badger is indeed at fault, the company Trail of Bits is not making themselves look good.

I just checked my Cloudflare account and assuming it hasn't changed too much since they set it up, on the API key creation page one is offered a number of common permissions setups none of which allow this type of attack. I believe this is sufficient evidence that the API key wasn't considered safe to distribute even internally around the company.

Time to finally set up my cold wallet yikes

Reply on news.ycombinator.com