In a recent security breach, hackers managed to exploit a Telegram trading bot Maestro, resulting in the theft of over 280 Ethereum (ETH), equivalent to $500,000.
Telegram trading bots are designed to streamline on-chain trading and farming, although some require users to share their private keys, raising concerns about security.
Exploiting External Call Vulnerability
The breach occurred due to an external call vulnerability in the Maestro Router 2 smart contract, as revealed by blockchain security firm Beosin.
Attackers exploited this vulnerability to pass a token address, designate the function as "transferfrom," and specify parameters like the victim's and their own addresses. This allowed them to transfer the victim's tokens to their address through the "transferfrom" function.
“Attackers can pass in a token address, fill in the called function as transferfrom, with parameters as the victim's address and their own address, so they can transfer the victim's tokens to their own address through transferfrom.”
Phishing Wallet Targets JOE Tokens
Another blockchain analysis firm, PeckShield, reported that a phishing wallet stole 37 million JOE tokens through an exploit.
#PeckShieldAlert#Fake_Phishing188297 has stolen ~37M $JOE as a result of the @MaestroBots router exploit, but there are ~26M $JOE available in the pool
Price impact: -30% https://t.co/bbcXqVYvR1pic.twitter.com/dV4kxoG6EL
— PeckShieldAlert (@PeckShieldAlert) October 25, 2023
a
This malicious activity caused the price of JOE to plummet by more than 30%, with Maestro unable to purchase JOE tokens to refund users due to a lack of liquidity.
Response and Recovery
Following the attack, the Maestro attacker transferred the stolen 280 ETH to Railgun, a crypto privacy tool designed to obfuscate transaction details.
In response, the Maestro team acted swiftly, identifying and addressing the exploit.
They updated their router to a secure, exploit-free implementation, allowing trading to resume normally. However, tokens associated with SushiSwap, ShibaSwap, and ETH PancakeSwap pools were temporarily unavailable.
Ensuring User Reimbursement
Maestro took responsibility for the incident and promptly refunded all affected users. The team purchased the tokens and sent them to the victims' wallets, ensuring that every affected wallet received the full amount they lost.
Maestro's Earnings and User Security
It's worth noting that in May 2023, Maestro's earnings reached over $20 million, with the trading bot collecting a monthly commission of $5 million at its peak. While Maestro offers the potential for substantial profits, it comes at the cost of users revealing their private keys to the bot to sign transactions.
This contradicts the decentralised ethos of "not your keys, not your coins."
Maintaining Caution in Bot Usage
In light of the Maestro attack, caution is advised when using such bots. As one Twitter user highlighted, "Maestro bot just got EXPLOITED 🚨 I never did trust all the stupid bots popping out left and right. Stay away from these bots. Be safe."
However, it's crucial to note that the exploit primarily targeted the router, and wallet credentials remained uncompromised, according to the Maestro team.