In December 2021, an attacker stole approximately $121 million from users of BadgerDAO, a decentralised finance platform. The attack involved malicious code planted on the project’s own website, which tricked users into granting permission to transfer their tokens. The attacker did not need to steal their private keys.
The incident illustrates a risk that checking the website address alone cannot eliminate: a legitimate website can be compromised, and the requests it sends to your wallet can be manipulated.
The BadgerDAO attack: a trusted website, malicious requests
According to Microsoft’s analysis, the attacker gained access to a Cloudflare API key – a credential used to manage services supporting BadgerDAO’s website. This access allowed malicious code to be inserted into the website’s front end: the interface visitors used to interact with the platform.
The altered interface prompted users to approve an address controlled by the attacker to spend their tokens. Once those permissions were granted, the attacker could use them to transfer the affected assets out of users’ wallets.
How attackers used Cloudflare to tamper with BadgerDAO’s website
The BadgerDAO attacker obtained a Cloudflare access key – effectively a digital pass that allowed changes to how the website was delivered. They used that access to insert malicious code into the real BadgerDAO website.
Visitors could be at the correct address and still receive wallet requests giving the attacker permission to spend their tokens. The malicious code appeared only intermittently and targeted selected wallets, making it harder to spot. For users, the lesson is straightforward: a familiar website using a well-known security provider can still serve a dangerous approval request.
Cloudflare, BadgerDAO and your wallet: practical security lessons
Keep your savings separate from your DeFi wallet.
Keep long-term holdings in a wallet secured by a hardware device, and avoid using that wallet for DeFi approvals. Use a separate address for swaps, DeFi and token claims, funded only with what you need for those activities.
Pause when a familiar website asks for something unexpected.
An unexplained approval request during a routine task deserves scrutiny – even on a website you have used for years. Check through a separately accessed official channel before continuing. A correct URL does not guarantee that the page has remained safe.
Understand what your hardware wallet protects.
A hardware wallet protects your private keys. Signing a malicious token approval can still give an attacker permission to move the approved tokens later, without another confirmation on your device. Keeping your seed phrase secret does not prevent this type of theft.
Know what to do after a suspicious approval.
Stop using the suspect website and promptly review and revoke the approval through a trusted tool – for Ethereum, one option is Etherscan’s token approval checker. Access it independently of the suspect website. Disconnecting your wallet does not cancel the permission, and revoking it cannot undo transfers already completed.
Need further guidance on your self-custody setup?
BitcoinVN offers white-glove, one-to-one consultations to review and guide your self-custody setup. We take the time to understand your circumstances and work through the full picture with you-from everyday access to backups and recovery – with recommendations tailored to your needs, experience and priorities.
