BitsLab’s ScaleBit flags ‘alarming’ Uniswap Wallet vulnerability

ScaleBit, a subsidiary of safety auditor BitsLab, has flagged a purported vulnerability that would probably compromise “all saved belongings” in decentralized trade (DEX) Uniswap’s Web3 wallets, ScaleBit advised Cointelegraph on Jan. 13. 

The alleged “flaw permits attackers with bodily entry to the gadget to bypass the pockets’s authentication mechanisms and straight retrieve the mnemonic phrase saved on the gadget,” ScaleBit mentioned in an announcement. 

A Web3 pockets’s mnemonic phrase, also referred to as a “seed phrase,” is a string of usually 12–24 random phrases that grants full management over a pockets’s belongings from any gadget. 

“[A]nyone with entry to an unlocked gadget can acquire the pockets’s mnemonic phrase in underneath three minutes,” ScaleBit mentioned, including that “this model persists even within the newest model of the app.” 

ScaleBit mentioned Uniswap Pockets customers ought to keep away from lending gadgets to others as a precautionary measure till the vulnerability is patched.

Uniswap representatives didn’t instantly reply to requests for remark. Cointelegraph was unable to independently confirm the vulnerability.

Associated: Winners and losers of 2024: A year of all-time highs, hacks and holding

Exploit losses

In 2024, cryptocurrency losses resulting from cybersecurity exploits increased 40% over the year prior to some $2.3 billion, safety agency Cyvers advised Cointelegraph in December. 

The rise mirrored a rise in entry management breaches, notably in centralized exchanges (CEXs) and crypto custodians, in line with Deddy Lavid, co-founder and CEO of Cyvers. 

Notably, losses to crypto scams, exploits and hacks tapered off in the last months of 2024, with December registering the smallest quantity stolen, blockchain safety agency CertiK mentioned in a Dec. 31 post on X.

CertiK mentioned December noticed $28.6 million in recognized losses to exploits, hacks and scams, versus $63.8 million in November and $115.8 million in October.

Blockchain safety agency PeckShield shared comparable information in a Jan. 1 post on X. It recorded $24.7 million in hack losses in December, which it mentioned was a 71% lower from November. 

Journal: Crypto to ‘Banana Singularity,’ Bybit halts India services, and more: Hodler’s Digest, Jan. 5–11