1. Blockchain Disasters
Nikolay Angelov
Blockchain Developer

2.
BTC $
ETH $

3. Where is the Problem?
Blockchain is Not
Aliens
secure
Human Mistakes

4. Nikolay Angelov Blockchain Trainer Software Engineer
Gamer - FOR THE HORDE!
/ghkgk
/in/Thedi

6. Mt. Gox
7th February 2014
740,000 Bitcoins - $473 Million

7. Mt. Gox Started on September 2011 Hot Wallet Leaked
Unencrypted Private Key

8. Mt. Gox
Blockchain is Not
Aliens
secure
Human Mistakes

9. The Parity Wallet Hack Multi-Signature wallet 153,037 ETH Stolen
InitWallet Bug

10. The Parity Wallet Hack

11. The Parity Wallet Hack

12. The Parity Wallet Hack

13. The Parity Wallet Hack
Blockchain is Not
Aliens
secure
Human Mistakes

14. Parity Wallet Freeze
Fixed and re-deployed the library contract on July 20th 2017
Using Library to save Gas

15. Parity Wallet Freeze
On November 6th 2017

16. Parity Wallet Freeze
“I’m a newbie and researching over that article. I ended at that contract. I triggered the kill” – devops199

17. Parity Wallet Freeze

18. Parity Wallet Freeze
587 wallets
513,774 ETH
Locked

19. Parity Wallet Freeze
Blockchain is Not
Aliens
secure
Human Mistakes

20. The Dao
17th June 2016
ETH Stolen
Leads to Fork

21. The Dao contract Dao { mapping (address => uint) public balances;
Stores Balance
contract Dao {
mapping (address => uint) public balances;
function deposit() public payable {
balances[msg.sender] += msg.value; }
function withdraw() public {
require(balances[msg.sender] > 0);
if (!msg.sender.call.value(balances[msg.sender])())
revert();
balances[msg.sender] = 0;
Checks
Balance
Tries to send the money
Reduces
Balance

22. The Dao Hacker Abused Fallback contract Hacker {
Holds Dao
Address
contract Hacker {
Dao private daoContract;
function() external payable {
if (daoContract.balance >= msg.value) {
daoContract.withdraw(); }
Calls Withdraw() Again

23. The Dao Dao Contract Hacker Contract Balance = 10; daoContract;
DrainDao()
Withdraw()
daoContract.Withdraw()
Checks Balance
Sends Money
Fallback Function
Sets Balance to Zero
Checks Dao Balance
daoContract.Withdraw()

24. The Dao
Blockchain is Not
Aliens
secure
Human Mistakes

25. Where is the Problem?
Human Mistakes

26. “Everyone here is a target for attack. Be paranoid.”
Martin Swende
ETH Foundation Security lead

27. General Philosophy Prepare for failure Rollout carefully
Keep Contracts simple

28. Read Best practices Consensys Best Practices Ethernaut – Be a hacker
Ethernaut – Be a hacker

29. Thanks! Nikolay Angelov Any questions? Find me @
/ghkgk
Any questions?
/in/Thedi