Concentric app falls victim to $1.7m social engineering attack on Arbitrum
The Arbitrum network recently experienced a significant breach of security, affecting the liquidity manager app Concentric. This breach was the result of a clever social engineering attack that allowed unauthorized access to a critical private key. This key belonged to the deployment account of the protocol and played a crucial role in the attack.
During the incident, the perpetrator successfully manipulated the protocol by upgrading the vaults and creating new liquidity provider (LP) tokens. These actions ultimately resulted in the extraction of assets from the vaults.
The breach was carried out by gaining control of an employee’s deployer wallet on Arbitrum. The stolen funds, totaling $1.7 million, were converted into Ethereum and dispersed across three wallet addresses. Following the incident, cybersecurity company Cyvers detected and reported suspicious activities, causing concern within the decentralized finance community.
Further investigation into the attack uncovered intriguing connections. CertiK, a blockchain security firm, identified a link between the wallet used in this breach and another wallet involved in a previous exploit of the OKX decentralized exchange in December. This connection suggests the possibility of the same individual or group orchestrating both attacks.
Liquidity management protocols, like the one utilized by Concentric, have gained popularity in the defi sector. These protocols play a crucial role in establishing price boundaries and managing liquidity pools within decentralized exchanges.
The rise in popularity of these protocols can be attributed to the introduction of the concentrated liquidity feature by Uniswap in 2021. This feature allows liquidity providers to define specific price ranges for asset trading, adding complexity to liquidity provision and increasing reliance on management protocols for asset handling.
