What Is a Zero-Day Exploit

Like with any heavily technological sphere, blockchain is prone to hacks. We can often hear the news that a particular project was attacked and users lost some of their assets. One of the most dangerous and difficult-to-fix types of such crimes is called a zero-day exploit. In March 2023, a blockchain security firm Halborn found a vulnerability in the code of over 280 projects, meaning that more than $25 billion could be at risk. 

In this article, we are going to discuss the zero-day exploit – what it is, and how it can affect crypto projects.

What is a zero-day exploit?

A zero-day exploit (zero-day attack, or 0-day) is a type of cybersecurity attack that takes advantage of a vulnerability or weakness in software or an operating system that the developers did not know previously. It is called this way because it is an attack that occurs on the same day that the problem is found, in other words, the developers have "zero days" to prepare for the vulnerability since no one is aware of it until it is used in an attack.

A zero-day exploit can be used by hackers to gain entry into a system, pilfer confidential data, or deploy malware, all while evading detection by security measures such as antivirus software and firewalls. Since the weakness remains unidentified, there are no available patches or updates to fix the situation, making it challenging for organizations to protect themselves from these types of cyber attacks.

Zero-day exploits are typically highly valuable to hackers and can even be sold on the dark web.

These types of exploits are especially dangerous in the sphere of blockchain and crypto as they can be used to steal digital assets, manipulate transactions, or interfere with the functioning of the blockchain network.

A zero-day exploit could potentially allow an attacker to gain access to a user's digital wallet or steal cryptocurrency by exploiting a vulnerability in the software. For example, an attacker can steal the private key of a user's wallet, which would allow them to transfer the user's cryptocurrency to their own wallet.

Case: Halborn discovery

The cybersecurity company Halborn which audits smart contracts, announced in March 2023, that they found a critical flaw in the code of lots of crypto projects.

The firm stated that a year ago they audited Dogecoin and found some serious potential exploits that could also harm other chains, including Zcash and Litecoin. Essentially, the vulnerability called Rab13s is connected to peer-to-peer messaging mechanisms, and it might allow hackers to create malicious consensus messages. Those are then sent to individual nodes making them go offline. As a result, this could cause a 51% attack.

One more code flaw discovered by the team could potentially allow cyber criminals to crash nodes or individual miners via remote procedure call requests.

The nature of zero-day exploits may vary across different blockchains, but it is probable that at least one of them poses a significant threat to each of the 280+ chains. Halborn has reached out to all affected projects and provided them with relevant information. They do not disclose any further details that could potentially endanger any of the blockchains. Although Dogecoin has addressed the security flaw, there may still be other projects that remain vulnerable to attacks by hackers.

To sum up, zero-day exploits can be a significant threat to blockchains. Not only do they disrupt the work of the chains, but also might lead to the loss of assets for companies and individuals alike. In order to protect the projects, the developers should update the software regularly, and carry out audits and tests.