SlowMist Chief Information Security Officer: Suspected Privilege Escalation Vulnerability at an Exchange Due to API Permission Control Issues

According to Foresight News, 23pds, Chief Information Security Officer at SlowMist, tweeted that a certain exchange carried out an API v3 upgrade on June 30, and he suspects that an issue with API permission controls led to a privilege escalation vulnerability. The reasons are as follows: the withdrawals were split into multiple transactions, and it is clear that there were nine malicious users involved. "Therefore, it is highly likely that the vulnerability was caused by the mixed use of old and new APIs, resulting in permission control or logic issues that were exploited by malicious actors."