Friend.tech, a popular DeFi project, is grappling with a major privacy breach that has resulted in the unauthorized disclosure of sensitive information pertaining to more than 101,000 individuals. The breach was brought to light by Banteg, a core contributor to Yearn Finance, who published a repository of scraped data on GitHub. This repository revealed critical details of Friend.tech users, including wallet addresses on Base and corresponding Twitter usernames.
“101,183 people have given Friend.tech access to post as them, leaked db (database) indicates,” shared Banteg in a tweet on Monday.
The breach goes beyond unauthorized access to user data. Banteg also highlighted a concerning situation regarding Friend.tech’s permissions, suggesting that users may have unwittingly granted the platform the ability to post on their behalf without fully understanding the extent of the permissions granted or providing explicit consent.
Unveiling the Extent of the Breach
The privacy breach was first discovered by analysts from Spot On Chain. They found that Friend.tech’s API had inadvertently leaked information, enabling users to view wallets created by other users along with associated Twitter usernames. Launched as a beta version on August 11, Friend.tech allows users to tokenize their social networks by buying and selling “shares” of their connections. The project operates on Coinbase’s layer-2 network, Base.
Friend.tech responded to the incident by attempting to downplay the severity of the breach. They claimed that the scraped information was publicly available through their API, comparing it to browsing someone’s public Twitter feed.
“This is just someone scraping our public API that shows the association between public wallet addresses and public Twitter usernames,” stated Friend.tech in a recent tweet.
The Implications and Growth of Friend.tech
The privacy concerns surrounding Friend.tech come at a time when the platform has experienced significant growth, attracting high-profile signups and accumulating protocol fees exceeding $1.42 million in the past 24 hours. As a result, Friend.tech has emerged as one of the top three crypto projects in terms of user-paid fees.
Driving the project forward is Racer, a developer who operates under a pseudonym. Racer has previously built social media networks based on non-fungible tokens (NFTs), such as TweetDAO and Stealcam. With Friend.tech, Racer aims to attract crypto influencers with large fan bases, giving them the opportunity to earn royalties from trading fees. The platform also seeks to strengthen relationships between Web3 projects, venture capitalists, and key figures in the crypto industry.
