Hedera: The attacker attacks the smart contract service code of the main network and transfers the user token to his account

On March 10, Hedera disclosed the details of the attack. The attacker attacked the smart contract service code of Hedera’s main network and transferred the Hedera Token service token held by some user accounts to his own account. The target of the attacker is to use accounts as liquidity pools on multiple DEXs, which are migrated to use Hedera Token Service using contracts derived from Uniswap V2, including Pangolin Hedera, SaucerSwap and HeliSwap.

Interpretation of this information:

On March 10, it was revealed that Hedera had suffered an attack on its main network in which an unknown assailant managed to compromise Hedera’s smart contract service code. As a result, the attacker was able to move Hedera tokens from user accounts to their own account. It appears that the attacker is motivated by a desire to use these accounts as liquidity pools on various Decentralized Exchanges (DEXs) that have migrated to use the Hedera Token Service, including Pangolin Hedera, SaucerSwap, and HeliSwap.

This news is concerning for a number of reasons. Firstly, it highlights the continuing susceptibility of DeFi platforms and smart contracts to hacking attacks. The attacker was able to exploit a vulnerability in Hedera’s smart contract code, which suggests that there may be further attacks of this nature in the future. Secondly, the fact that the attacker is using user accounts as liquidity pools on DEXs raises concerns around the transparency and security of these platforms, which are increasingly becoming the subject of regulatory attention. Finally, it is concerning that the attacker has been able to move Hedera tokens out of user accounts and into their own account. This calls into question the security of Hedera’s token service, and may cause users to lose confidence in the platform.

In response to the attack, Hedera has stated that it is “actively investigating the matter” and has “implemented additional security measures”. However, it is unclear what those security measures entail or whether they will be effective in preventing similar attacks in the future. As such, the Hedera Token Service remains a potentially risky platform for users to transact on.