Incident: Human Error Leads to $36 Million Crypto Loss in Juno Blockchain

Published Date: 2022-05-05

Postmortem Analysis
Timeline 1. The software failure incident involving the incorrect transfer of $36 million in crypto for Juno cryptocurrency happened around May 2022. [128194]
System 1. Validator system in the Juno blockchain [128194]
Responsible Organization 1. The developer who inadvertently copy and pasted the wrong wallet address, leading to the $36 million in crypto being sent to an inaccessible address [128194].
Impacted Organization 1. Juno cryptocurrency developers and community members [128194]
Software Causes 1. The software cause of the failure incident was a developer inadvertently copy and pasting the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address [128194].
Non-software Causes 1. Human error: The incident occurred due to a developer inadvertently copy and pasting the wrong wallet address, leading to the transfer of $36 million in crypto to an inaccessible address [128194]. 2. Lack of validation by network validators: None of the 125 network validators checked the transaction for errors, allowing the incorrect transfer to go through without detection [128194].
Impacts 1. $36 million in crypto was sent to an inaccessible address due to the developer inadvertently copy and pasting the wrong wallet address, leading to financial loss [128194]. 2. The network validators failed to catch the mistake, highlighting a lack of oversight in the transaction verification process [128194]. 3. The incident showcased the challenges of immutability in blockchain technology, where reversing human errors can be difficult or impossible [128194].
Preventions 1. Implementing stricter verification processes for transactions, such as requiring multiple individuals to review and confirm wallet addresses before funds are transferred could have prevented the incident [128194]. 2. Providing additional training or guidance to developers on the importance of accurately copying and pasting wallet addresses to avoid errors [128194]. 3. Enhancing the blockchain network's validation system to include checks for common human errors, like verifying that the correct type of data is being copied and pasted during transactions [128194].
Fixes 1. Implementing a governance model where token holders can vote to alter blockchain transactions, as in the case of Juno cryptocurrency, could help fix the software failure incident by allowing for a majority vote and a subsequent software update to recover the funds sent to the wrong address [128194].
References 1. Andrea Di Michele, one of Juno's founding developers [128194] 2. CoinDesk [128194] 3. CNET [128194]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown <Article 128194> The article discusses a software failure incident related to a human error in the Juno cryptocurrency blockchain. The incident involved a developer inadvertently copying and pasting the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address. This incident highlights the challenge of reversing transactions on a blockchain due to its immutable nature. The incident also points out that none of the network validators caught the mistake, emphasizing the importance of validators in verifying transactions on a blockchain. The article mentions that blockchain developers have found ways to reverse transactions in the past, such as the case when Ethereum developers had to "hard fork" their blockchain to recover stolen funds in 2016. In the case of Juno, the incident is expected to be resolved through a governance model where token holders can vote to alter blockchain transactions and a software update will be implemented to recover the funds [128194]. Regarding the software failure incident happening again at one_organization or multiple_organization, the article does not provide specific information about similar incidents happening before within the same organization (one_organization) or at other organizations (multiple_organization). Therefore, the information to determine if similar incidents have occurred again at one_organization or multiple_organization is unknown based on the provided article.
Phase (Design/Operation) design (a) The software failure incident in the Juno cryptocurrency case was primarily due to a design-related issue. A developer inadvertently copy and pasted the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address. This mistake occurred during the transfer process, which was a result of human error in copying and pasting the incorrect information provided by another developer [128194]. (b) The software failure incident in the Juno cryptocurrency case did not involve operation-related factors such as misuse of the system. The failure was primarily attributed to a design flaw in the transfer process, where the wrong wallet address was copied and pasted, resulting in the funds being sent to an inaccessible address [128194].
Boundary (Internal/External) within_system (a) The software failure incident related to the Juno cryptocurrency sending $36 million in crypto to an inaccessible address was primarily within the system. The incident occurred due to human error where a developer inadvertently copy and pasted the wrong wallet address, leading to the funds being sent to an inaccessible address [128194]. Additionally, the lack of validation by any of the 125 network validators also contributed to the failure within the system, as none of them caught the mistake during the transaction process [128194].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the Juno cryptocurrency case was primarily due to non-human actions. Specifically, the incident occurred because a developer inadvertently copy and pasted the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address. This mistake was not intentional but rather a result of copying and pasting the hash number instead of the correct wallet address [128194]. (b) However, human actions also played a role in the failure incident. The human error of copying and pasting the wrong address was a critical factor in the incident. Additionally, the developer responsible for the transfer failed to verify the accuracy of the address before initiating the transaction. Furthermore, the lack of validation by any of the 125 network validators also contributed to the failure, indicating a potential oversight in human actions [128194].
Dimension (Hardware/Software) software (a) The software failure incident in the Juno cryptocurrency case was not directly attributed to hardware issues. The incident occurred due to human error where a developer mistakenly copy and pasted the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address [128194]. (b) The software failure incident in the Juno cryptocurrency case was primarily attributed to a software error. The mistake occurred when a developer inadvertently copied and pasted a hash number instead of the correct wallet address, resulting in the transfer of funds to an inaccessible address. Additionally, the lack of validation by the network validators also contributed to the failure, as none of the 125 validators caught the mistake during the transaction process [128194].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident in the Juno cryptocurrency involved a malicious aspect where around 3 million Juno tokens, worth $36 million, were to be seized from an investor deemed to have acquired the tokens via malicious means. This decision was made through a community vote [128194]. (b) The software failure incident also had a non-malicious aspect where the failure occurred due to human error. A developer inadvertently copy and pasted the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address. The mistake was attributed to the developer accidentally copying and pasting a hash number instead of the correct wallet address [128194].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor_decisions: The software failure incident involving the Juno cryptocurrency was primarily due to poor decisions made by a developer who inadvertently copy and pasted the wrong wallet address during a transfer of $36 million in crypto. This mistake led to the funds being sent to an inaccessible address, causing a significant issue for the project [128194]. Additionally, the fact that none of the network validators caught the mistake also points to a lapse in oversight and validation processes, highlighting further poor decisions in the incident. (b) The intent of the software failure incident related to accidental_decisions: The software failure incident can also be attributed to accidental decisions made by the developer responsible for the transfer. The mistake of copying and pasting the hash number instead of the correct wallet address was unintentional, leading to the erroneous transfer of funds. This accidental decision resulted in the $36 million crypto being sent to an inaccessible address, showcasing the impact of unintended errors in software operations [128194].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the Juno cryptocurrency occurred due to development incompetence. A developer inadvertently copy and pasted the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address. This mistake was attributed to the developer's error in copying and pasting the hash number instead of the correct wallet address, despite being provided with the correct information by Andrea Di Michele, one of Juno's founding developers [128194]. (b) The software failure incident in the Juno cryptocurrency also involved accidental factors. The incorrect transfer of $36 million in crypto was a result of the developer accidentally copying and pasting the hash number instead of the correct wallet address. This accidental error led to the funds being sent to an inaccessible address, highlighting the impact of human error in software transactions [128194].
Duration temporary The software failure incident described in the article is more aligned with a temporary failure rather than a permanent one. The incident occurred due to a specific human error where a developer inadvertently copy and pasted the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address [128194]. This specific circumstance of human error contributed to the failure, and the article suggests that the issue can be resolved with a software update and a majority vote from token holders to alter blockchain transactions. This indicates that the failure is not permanent but can be rectified through specific actions within a certain timeframe.
Behaviour omission, value (a) crash: The incident described in the article does not involve a system crash where the system loses state and stops performing its intended functions. (b) omission: The software failure incident in the article can be categorized as an omission. The failure occurred when a developer inadvertently copy and pasted the wrong wallet address, leading to $36 million in crypto being sent to an inaccessible address [128194]. (c) timing: The software failure incident is not related to timing issues where the system performs its intended functions but at the wrong time. (d) value: The software failure incident is related to a value issue where the system performed its intended function (sending funds) but did so incorrectly by sending the funds to the wrong address due to human error [128194]. (e) byzantine: The software failure incident does not exhibit characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident can be categorized as a value-related failure due to the incorrect performance of the system's intended function of transferring funds [128194].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving the Juno cryptocurrency resulted in $36 million in crypto being sent to an inaccessible address due to a developer inadvertently copy and pasting the wrong wallet address [128194]. This led to a significant financial impact as the funds meant to be seized from an investor and sent to a wallet controlled by Juno token holders ended up inaccessible due to the error.
Domain finance (a) The failed system in the incident was related to the finance industry. The software failure incident involved the Juno cryptocurrency, where $36 million in crypto was mistakenly sent to an inaccessible address due to a developer's error in copying and pasting the wrong wallet address [Article 128194]. This incident highlights the challenges and risks associated with blockchain technology in the finance sector.

Sources

Back to List