Loopring suffered a security breach attack whereby several wallets were compromised. Via a post on X, the Ethereum-based ZK rollup protocol’s team revealed,
“The attack exploited wallets with only one Guardian, specifically the Loopring Official Guardian. The hacker initiated a Recovery process, falsely posing as the wallet owner to reset ownership and withdraw assets."
Using the Guardian service, users can pick trusted wallets - they can either be hardware or software addresses that they or trusted third-parties like an institutional service, family member, or friend possess - to help chip-in towards security operations. That can range from locking affected wallets to restoring wallets when seed phrases are lost.
By compromising Loppring’s two-factor authentication, the hacker was able to impersonate the wallet owner and gain approval for recovery from the Official Guardian. Right after, the attacker transferred assets out of the affected wallets.
That being said, wallets that relied on multiple guardians or another different, out-house guardian were shielded from the exploit. Loopring labels itself to be “Ethereum’s most secure wallet.”
The team tied-up with Mist securities experts to find out how its two-factor authentication service was compromised.
When it comes to user protection, the team has temporarily halted Guardian and 2FA-related operations. On the heels of this action, the compromise came to an end, the Loopring team revealed.
Furthermore, Loopring is also working with law enforcement and centralized exchanges to track down the perpetrator and recover funds. Users who have experienced asset losses during the wallet compromise have been asked to get in touch with the team.
Cyvers, a blockchain security team pointed out via a post on X,
“All the stolen digital assets have been swapped for ETH and the address currently holds over $5M 1373 ETH.”
Loopring’s native token LRC was exchanging hands at $0.2214, down 0.71% over the past day.
