Crypto wallet providers urged to rethink security as criminals drain them of millions

Infosec researchers are noting rising cryptocurrency attacks and have encouraged wallet security providers to up their collective game. Check Point specifically cites the growth of attacks that abuse Ethereum's CREATE2 opcode, dubbing it a "critical issue in the blockchain community" that's seeing millions of dollars worth of assets being drained from victims' wallets. Introduced in 2019, CREATE2 is seen as a significant advancement for Ethereum, allowing for more efficient deployments of smart contracts – the technology that validates transactions on the blockchain. CREATE2 is also the function that's being exploited by attackers to drain tokens from victims' wallets. One of its key capabilities is being able to deploy smart contracts to pre-determined addresses, making the entire process more predictable for the blockchain when dealing with multiple contract interactions across the ecosystem of decentralized applications. By pre-determined, it means that an attacker can create temporary, single-use addresses to receive a victim's assets. New addresses can be used for each attack, and this is crucial because wallet security providers rely on previously held data to flag potentially malicious transactions. If the address has no dodgy history, it's likely the transaction will evade these detections. The fact that attackers can set up a contract before deploying it (before it even exists), using a wallet address that doesn't have a history of malicious activity, means that if t...