# Let's Learn from the Odin.fun Hack - Preventing Attack Vectors **URL:** \ **Category:** Developers\ **Tags:** Discussing\ **Created:** [April 15, 2025, 4:41am UTC](https://forum.dfinity.org/t/lets-learn-from-the-odin-fun-hack-preventing-attack-vectors/43848 "2025-04-15T04:41:10Z")\ **Posts on this page:** 1\ **Showing post:** 55
**Author:** ![josephgranata](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/josephgranata/32/21930_2.png) [@josephgranata](https://forum.dfinity.org/u/josephgranata)\ **Post date:** [April 24, 2025, 6:53pm UTC](https://forum.dfinity.org/t/lets-learn-from-the-odin-fun-hack-preventing-attack-vectors/43848/55 "2025-04-24T18:53:58Z")
Today @robin-kunzler who leads DFINITY’s Security team has provided a clear diagnosis of what happened behind the hack of the Odin.fun canister. These are the most important paragraphs, but I suggest you carefully read the whole post, and follow his advice: > Whenever possible, use vetted libraries or platform features for security-critical functionality and do not implement it on your own. If you use third-party components that are security-critical, make sure they went through a security audit and ideally have a bug bounty program in place. A bug bounty program can incentivize and motivate people to look for and responsibly report bugs they find (see e.g. [DFINITY’s bug bounty program](https://dfinity.org/bug-bounty/)). > Similarly, if you write security-critical components yourself and stakes are high, perform security audits and consider running a bug bounty program. Furthermore, ideally the development processes aim at high quality and security. Thorough design and peer reviews and testing increase confidence. The [ICP security best practices](https://internetcomputer.org/docs/building-apps/security/overview) should be used as a reference. > **What can be done to be better prepared for attacks?** > > - _Observability - make sure you notice attacks._ Ideally, projects implement automated alerting for suspicious activities, such as exceptionally large transfers, spikes in usage or logins, etc.\ > - _Store data to enable forensic investigations._ Logging important user actions such as authentication, transfers, withdrawals, etc. can prove very useful to retrospectively understand an attack, identify victims and attackers, trace funds and enable forensic investigations in general. The key part where the code contained an implementation error that made the hack, and the stealing of funds is explained here: > **[ic\_siwb\_provider: Insufficient key validation for ECDSA signatures leads to...](https://github.com/AstroxNetwork/ic-siwb/security/advisories/GHSA-xqx6-6wr2-m9pc)** > > \> \[!CAUTION\] > \> TL;DR: Identity providers must redeploy their SIWB instances immediately with the latest build of \[ic\_siwb\_provider\](https://github.com/AstroxNetwork/ic-siwb/tree/184c2ed874c3c80024... Here is the link to the full post: > [@Critical Vulnerability in Sign-In With Bitcoin (SIWB) used to Attack Odin.fun - Learnings and Discussion](https://forum.dfinity.org/t/critical-vulnerability-in-sign-in-with-bitcoin-siwb-used-to-attack-odin-fun-learnings-and-discussion/44721): > > Hi, On Monday April 14, DFINITY’s security team was involved to investigate the [Odin.fun](https://odin.fun/) security incident where user funds were stolen (Odin’s [postmortem tweet](https://x.com/BobBodily/status/1911930973064974598)). We identified a critical vulnerability in the sign-in with Bitcoin ([SIWB](https://github.com/AstroxNetwork/ic-siwb)) canister developed by AstroX and deployed by Odin.fun, allowing people to sign in directly by signing a message using their Bitcoin wallet. In short, SIWB was missing a check to validate that the public key used to verify the signature created by the Bitcoin wal… Joseph Hurtado Founder Satoshi Notes Founder Granata Consulting --- _[View the full topic](https://forum.dfinity.org/t/lets-learn-from-the-odin-fun-hack-preventing-attack-vectors/43848)._