Loopring (LRC), the zkEVM protocol built on Ethereum and boasting of having “Ethereum's most secure wallet,” announced a security breach related to its 'Guardian' two-factor authentication service.
The Guardian service allows users to identify trusted individuals or institutions in their wallets to assist with security operations, such as locking a compromised wallet or restoring the wallet if the seed phrase is lost. However, a hacker managed to bypass Loopring's own Official Guardian service and initiated recoveries on wallets with this single guardian without users' permission.
According to Loopring's website, more than half of the custodial wallets are needed to initiate transactions. Therefore, wallets that used multiple protectors or a different third-party protector were protected from the vulnerability.
Loopring shared two wallet addresses that it claimed were involved in the security breach. Blockchain data reveals that one wallet was able to withdraw approximately $5 million worth of tokens from affected wallets.
“We are actively collaborating with Mist security experts to determine how our 2FA service was compromised. To protect our users, we have temporarily suspended Guardian-related and 2FA-related operations. Following this action, the vulnerability has ended,” Loopring said in a statement. said.
Protocol also said it was working with law enforcement to track down the attacker and asked anyone with additional information about the attack to share it with them.
*This is not investment advice.
