Pen Tokens ....1/315 May 2023 16:37
In mid-April, a number of PEN tokens experienced a breach perpetrated by an attacker, resulting in temporary deposit pauses on the crypto exchange MEXC. Acting swiftly and in close collaboration with MEXC, the Pendulum team effectively averted any significant consequences. The Pendulum team are pleased to report that the stolen PEN tokens have been successfully brought under the control of their rightful owner, and deposits have resumed on MEXC. In this article, we aim to provide transparent insights into the incident, offering a comprehensive breakdown of the events that transpired.
What Happened
A strategic community supporter inadvertently disclosed a wallet seed phrase to a third party, resulting in the breach of their PEN accounts. The attacker, posing as an admin on Telegram, exploited the victim’s trust, ultimately leading to the compromise of their wallet.
The attacker took control of the wallet and began sending unlocked PEN tokens to MEXC for selling purposes. Once the victim realized their wallet had been compromised, they promptly reached out to the Pendulum team for advice and help on mitigation. The team acted swiftly by contacting MEXC who halted deposits, preventing the attacker from further selling PEN tokens and ensuring the protection of the community.
In response to the incident, the Pendulum team advised the victim to stake their entire balance, effectively locking the tokens for a period of at least seven days. The victim was also encouraged to inform local authorities about the breach. This proactive measure was in accordance with Pendulum’s staking pallet, which requires a seven-day unbonding period. It allowed for the necessary time to inform local authorities, work collaboratively towards a solution, and minimize the impact of the incident.
Social Engineering Attack Attempt
The victim was seeking help on the official Telegram channel of a wallet provider. They were then contacted per private message by the attacker, disguising themselves as admin of that channel.
The victim was under the impression they were communicating with an official representative of the wallet project and requested help in staking their PEN. The attacker then directed the victim to a website extracting their private keys — which rendered the wallet’s control in the hands of the attacker. PEN tokens were then unstaked from these addresses:
6gDQi9wtrATW28fXMkJodRKLCBW8YipJbKdUhiu8xSnBapJr
6gcrqpLP5nyyWHPbV8jmeEfhhGxADZgRwWkB6pMPAedryYqP
And after the 7-day unbonding period ended, some of the PEN on these addresses was sent to MEXC to be sold, causing a spike in sell volume. The victim, with the help of the Pendulum team, staked their tokens immediately after learning of the breach. The attacker unstaked them again, in an attempt to gain sole access to the assets.
Sign In
Follow the stocks
