Users of the Loopring application, a wallet for the eponymous network (which is a layer 2 of Ethereum) were hacked for more than $5 million in total.
Loopring is a wallet based on smart contracts. On its website it claims to be the "most secure" wallet for Ethereum.
On June 9, after learning of the attack on the wallets of different users, the organization that developed these technologies (the wallet and the second layer network) referred to what happened through its official X account , where it linked a series of addresses to the attackers. From Loopring they explained that the hackers managed to corrupt the 2FA authentication system and were able to replicate the identity of the owner of the wallets to enter them.
"The attack was successful in compromising Loopring's 2FA service, allowing the hacker to impersonate the owner of the wallets and obtain Official Guardian approval for recovery."
Loopring, smart wallet platform for the Ethereum Layer 2 network.
In Ethereum block explorers, it is observed that one of the addresses published and associated with the Loopring attack contains transactions from Sunday, June 9. There you can see the 1,373 ether he received, valued at almost $5 million.
Loopring detailed that the services related to guardians and 2FA are temporarily suspended and that they are working to find who committed this theft.
To understand what happened, it is important to clarify that Loopring offers its users the social recovery system instead of using seed words. This means that permissions to sign transactions are held by multiple gatekeepers (which are people, entities, or devices designated by the user). Loopring offered an “official guardian” for its wallets and this is the one that was compromised.
Something striking is that the founder of Ethereum, Vitalik Buterin, has expressed himself on several occasions in favor of the use of social recovery wallets. He points out the importance of correctly choosing the guardians who guard the wallets to minimize risk. One might have thought that using Loopring's official guardian was a sure thing, but evidently that wasn't the case.
