WhiteHat Hacker Paid dollar6 Million After Preventing 330 dollarMillion Hack
Categories: US
Aurora, an Ethereum bridging and scaling solution that runs on the NEAR protocol, announced on June 7 that it had paid US$6 to a WhiteHat hacker for finding a bug. million was awarded. Users have lost up to US$330 million: the bug was reported to Aurora on April 26 via ImmuneFi, a leading Web3 bug bounty platform.The hacker who found the bug has been identified only by their Ethereum domain name, pwning.eth. Aurora has confirmed that this bug was patched before any user funds were lost. The bug would have allowed an attacker to mint infinite ETH; the bug was described by Aurora as an "inflation vulnerability". If exploited, the bug would have allowed an attacker to have an unlimited supply of artificial ETH, which they could then use to completely extract real ETH from Aurora's bridge contract – more than 70,000 ETH, which is worth more than 70,000 ETH. The value was over US$200 million.Other assets with ETH pairs valued at around US$130 million also would have been at risk. In total, up to US$330 million of assets could have been stolen. Fortunately for Aurora, the hacker decided to report the bug and claim a bounty of US$6 million, the largest ever offered by Aurora and the second largest bug bounty paid in crypto history. The Aurora payout follows a US$2 million bug bounty paid in February to a WhiteHat hacker who identified a vulnerability in an Ethereum scaling solution, Optimism, that would be exploited.Allowed an attacker to mint unlimited ETH. Bug bounty platform Immunefi says it has paid out more than US$40 million to date, which it claims has prevented more than US$20 billion in potential damages from the hack.