«It was assumed that 100 eth had been lost, but finally they could be recovered,» Lukas Schor, co -founder of Safe, a Wallet of Ethereum, wrote on June 3.
This story began as a financial disaster for a person who tried to transfer 100 Ethher (ETH), equivalent to around $ 260,000, from the main network of Ethereum to the second layer (L2) base, using a Wallet Safe:
«I lost all my life savings with a single click using Safe last night.»
Khalo, X user, victim of the ruling in Ethereum.
A outdated wallet and an error almost lost 100 eth
The case, explained by Schor, reveals how an error in an ancient version of a Wallet Safe allowed the funds to be trapped in an inaccessible direction in the destination network.
The user who calls Khalo tried to move 100 eth from the main network of Ethereum to the base using a bridge, a tool that allows to transfer assets between two different chains.
The bridges function as intermediaries that block assets in one chain and generate an equivalent in the other, a process that should guarantee that The transferred value is maintained.
In this case, Khalo used a Wallet Safe in its 1.1.1 of 2020 version, and, as Schor explained, that old version lacked a crucial protection mechanism: Domain control for multicadena deployments.
Due to that limitation, another person was able to create a Safe purse with the same direction on the base network before Khalo completed the transfer.
When the 100 eth were sent through the bridge, they reached that address based, but the user had no control over it, since it was not the Wallet that he had configured. This ruling left the lost funds, trapped in a direction managed by another person.
The recovery of the funds
According to Schor, the user contacted the SAFE support team, who started an analysis of the problem. This analysis took them to Protofire, a company dedicated to the development of “Blockchain” solutions, security audits and intelligent contracts, especially in networks such as Ethereum.
Protofire, as Lukas Schor explained, had already identified that vulnerability in the Wallets Safe of old versions, such as 1.1.1, which allowed third parties to create purses with identical addresses in other chains before the legitimate user did.
Aware of that risk, protofire He had deployed preventively Directorates based with an ethical approach to block possible attempts at malicious hackers that could take advantage of this failure to seize trapped funds.
Thanks to this preventive intervention, Safe’s team was able to contact Protofire and «just two hours since the incident was reported,» according to Shor’s sayings, they managed to confirm that the 100 ETH were in a Wallet controlled by Protofire based on base. Subsequently, ETH were returned to Khalo.
«The funds have been recovered!» He exclaimed in X Khalo, after the rescue of his ETH ($ 260,000).
Learn Lessons and Preventive Measures
To prevent similar incidents from occurring, Safe has implemented modifications in its most recent versions. From version 1.3.0, those wallets include a domain separation mechanism that prevents the creation of contracts with the same direction in different chainsunless they are explicitly authorized by the owner.
This update would ensure that users do not face the risk of losing funds due to address collisions between networks.
«If you are using an old version of Safe, such as 1.1.1, consider migrating to a more recent to take advantage of security improvements,» Schor wrote in his publication.
This incident that involved Safe, as in the attack on the exchange bybit in which around 1.5 billion dollars were stolenIt highlights both the vulnerabilities of the bridges between networks and the importance of updating the Self -Custody Wallet Softwares, as well as the importance of education in the use of technologies with cryptocurrencies.