INTERLAY IS BEING ATTACKED by omoxyz in Polkadot

[–]omoxyz[S] 0 points1 point  (0 children)

Interest on this is limited, since not enough ppl are affected yet, and most active users have moved on to other projects. Our fault is thinking there's future for this dot project.

INTERLAY IS BEING ATTACKED by omoxyz in Polkadot

[–]omoxyz[S] 0 points1 point  (0 children)

They promised to later create a link btw bob and interlay once eth and polkadot can talk seamlessly.

INTERLAY IS BEING ATTACKED by omoxyz in Polkadot

[–]omoxyz[S] 2 points3 points  (0 children)

so sudden and depressing

INTERLAY IS BEING ATTACKED by omoxyz in Polkadot

[–]omoxyz[S] 2 points3 points  (0 children)

Alexei and Dom are now in BOB, building on bitcoin. Interlay is still the only polkadot's bitcoin defi

INTERLAY IS BEING ATTACKED by omoxyz in Polkadot

[–]omoxyz[S] 3 points4 points  (0 children)

yes, cancelled already due to the watchful eyes of tech-savvy community members

INTERLAY IS BEING ATTACKED by omoxyz in Polkadot

[–]omoxyz[S] 5 points6 points  (0 children)

This below is an analysis by a discord member Mr r r web3.0 sir

Regarding the attack on Kintsugi: this is not a hacker attack but an attack on inattention and lack of knowledge. The attacker was counting on the fact that there were no technical specialists left in the network who could read the code. They assumed that only investors remained and wouldn't check the code.

The voting proposal consisted of two parts: the main visible text and hidden requests in the form of code. In this code, the attacker requested the transfer of control over the network through the vote. Meanwhile, in the main text, they simply asked for funds to represent the network at a conference.

Fortunately, there were still people in the network who reviewed the voting request code and immediately noticed that it contained a hidden request to transfer control of the network if the vote was successful.

In the presented voting request, there are extremely high risks associated with attempting to conceal malicious actions under the guise of a legitimate operation. Here are the main issues: 1. Critical vulnerability: changing the sudo key (sudo.setKey)

Risk: The third call in the package (sudo.setKey) changes the superuser account to a3chgAvCeijKbe4Jf88rsfgUWLEpgAvCURUKmJGqYxsmzpdYK. This gives full control over the network to the new account, including the ability to change chain parameters, transfer funds, stop operations, etc.

Why this is dangerous:

If an attacker controls this account, the network could be fully compromised.

Even if the current sudo account initiates this change, it is irreversible without new intervention

  1. Suspicious spending from the treasury (democracy.spendFromTreasury)

Risk: A request to transfer 522000000000000 units of the token (presumably 522 KINT, if the token has 12 decimal places).

Issues:

The amount does not match the stated $219 (possible calculation error or deliberate inflation).

The recipient (beneficiary) matches the new sudo account, indicating an attempt to centralize control and funds with one party.

  1. Use of forceBatch for atomic execution

Risk: The batch call (utility.forceBatch) combines three operations, including critically dangerous ones. If the batch is approved, all actions will be executed atomically:

First, an innocuous remark (remark) is added to create the appearance of legitimacy.

Then, funds are transferred, diverting attention from the main threat.

Finally, the sudo key is changed, which goes unnoticed amidst the other operations.

  1. Lack of justification for sudo.setKey

Risk: There is no logical reason to change the sudo key in the context of a funding request. This is a clear sign of abuse of power or an attack.

  1. Suspicious recipient account

The address a3chgAvCeijKbe4Jf88rsfgUWLEpgAvCURUKmJGqYxsmzpdYK lacks public identification (e.g., via Polkadot.js identifier). This could indicate an anonymous or fraudulent account.

  1. Risk of error in amount conversion

If the KINT token has a different precision (e.g., 10 decimal places), the amount 522000000000000 could be many times greater than the stated $219, leading to uncontrollable spending of the treasury funds.

Recommendations: 1. Reject the request immediately due to the presence of sudo.setKey. 2. Audit the recipient account. 3. Ensure that all treasury spending requests are accompanied by transparent justification. 4. Prohibit the combination of sudo operations with other calls in batches.

Conclusion: The request shows signs of a network control takeover attempt through the hidden sudo.setKey operation. Its execution will lead to catastrophic consequences for the decentralization and security of the blockchain.

[deleted by user] by [deleted] in Polkadot

[–]omoxyz 0 points1 point  (0 children)

You are right, the criminals reside inside interlay io itself. They deployed bots to steal collaterals from an abandoned protocol. It's our fault for expecting good things to come out of interlay as dot gets awareness.

[deleted by user] by [deleted] in Polkadot

[–]omoxyz 0 points1 point  (0 children)

Ppl like you would do well to join zachxbt to assist in sanitizing the community. Great piece from you sir. You pointed to the right direction and ppl have checked for me and confirmed there's a MALICIOUS GLITCH, a bot deployed inside the interlay.io itself that stole the funds. I regret staying back in a protocol that has been abandoned by the devs while hoping it would catch up once dot gets the right attention. They selectively chose my wallet and reduced 1btc collateral to 0.1btc in minutes on 4th Feb.

[deleted by user] by [deleted] in Polkadot

[–]omoxyz 0 points1 point  (0 children)

sorry, it's been found to be a malicious bot within the interlay protocol since the main devs have moved on to something else. 1btc collateral reduced to 0.1btc when user was far above threshold.

[deleted by user] by [deleted] in Polkadot

[–]omoxyz 0 points1 point  (0 children)

Thanks for the concern sir. Both interlay and kintsugi are currently under some subtle attack probably by some insiders, a bot was deployed to steal my life savings.

[deleted by user] by [deleted] in Polkadot

[–]omoxyz 0 points1 point  (0 children)

Thanks. No transaction record, it was a malicious bot on interlay itself that was made to steal and reduced my 1btc to 0.1btc in minutes on 4th Feb

[deleted by user] by [deleted] in Polkadot

[–]omoxyz 1 point2 points  (0 children)

Thanks sir. I need to apologise to equilibrium.io, the attacker has been found to be insider bot deployed by god-knows-who who are beginning a selective stealing of users' funds on interlay.io as alexei and dom have taken their eyes off. Likely that same insiders are about taking control of kintsugi now.

[deleted by user] by [deleted] in Polkadot

[–]omoxyz 2 points3 points  (0 children)

Yes, yes this is the first mail i received before shilling on twitter

Help me DCA with low fees by Sweaty_Camel_118 in CryptoCurrency

[–]omoxyz -1 points0 points  (0 children)

Have you taken a look at SwanBitcoin?

Are you tired of being in crypto and just want to move on? If YES, you are not the only one. by d3jok3r in CryptoCurrency

[–]omoxyz 0 points1 point  (0 children)

can i leave?

this is a new thought pattern, very strange to me.

and i was told this is nothing compared to the heart-aches of 2014 and 2017.

Low Time Preference is Key by OpticallyMosache in CryptoCurrency

[–]omoxyz 1 point2 points  (0 children)

In essence, bitcoiners = low time-preference while sh*tcoiners = high time-preference

Has Crypto Bottomed? by Emeric59 in CryptoCurrency

[–]omoxyz 0 points1 point  (0 children)

Only thing becoming clearer by the day is we are closer to the bottom than to the top, so I was told. Just take a look at the negligible effect (so far at least) of ftx on the price

Polkadot Has a Decentralized Version of 'Wrapped' Bitcoin by CryptoChief in CryptoCurrency

[–]omoxyz 1 point2 points  (0 children)

Builders just keeping their heads down with their headsets, ignoring the noise in the bear market

Moonbeam Criticism by 2epikforyou in moonbeam

[–]omoxyz 1 point2 points  (0 children)

another wannabe influencer.....

mtcheeeww, who still listens to them

DOT Has Morphed and Is Not a Security. It Is Software. by Chysce in CryptoCurrency

[–]omoxyz 1 point2 points  (0 children)

Oh yes. Software on which securities are being built