Topic: DeFi hacks [history] - page 17. (Read 19555 times)
So far there have been no hacks or exit scams on NEAR protocol, it's a trustworthy community.
Popsicle Finance- 25M
https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million
A bug in Popsicle Finance allowed hackers to drain one of the DeFi protocol’s key products for roughly $25 million.
"Popsicle Finance, a multi-chain yield-generating crypto project, has melted under the heat of a new exploit.
The $25 million heist was revealed by security researcher Mudit Gupta, who said “the hack was complex but the bug was simple.” In a Twitter thread, Gupta also explained how he reported a similar bug in another protocol, adding that the error “has been exploited in like a dozen other protocols already.”"
https://twitter.com/Mudit__Gupta/status/1422797923037814786
https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million
A bug in Popsicle Finance allowed hackers to drain one of the DeFi protocol’s key products for roughly $25 million.
"Popsicle Finance, a multi-chain yield-generating crypto project, has melted under the heat of a new exploit.
The $25 million heist was revealed by security researcher Mudit Gupta, who said “the hack was complex but the bug was simple.” In a Twitter thread, Gupta also explained how he reported a similar bug in another protocol, adding that the error “has been exploited in like a dozen other protocols already.”"
https://twitter.com/Mudit__Gupta/status/1422797923037814786
I hadn't heard of this project before but it seems that yield optimizers are a big target for attackers. PancakeBunny suffered one of the biggest losses earlier this year through a flash loan attack and then a few months later they were attacked again on the Polygon version of PancakeBunny. The benefit of using these optimizers is in the extra rewards they give you by going through their platform but the complexity of their contracts makes them more susceptible to exploits.
Popsicle Finance- 25M
https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million
A bug in Popsicle Finance allowed hackers to drain one of the DeFi protocol’s key products for roughly $25 million.
"Popsicle Finance, a multi-chain yield-generating crypto project, has melted under the heat of a new exploit.
The $25 million heist was revealed by security researcher Mudit Gupta, who said “the hack was complex but the bug was simple.” In a Twitter thread, Gupta also explained how he reported a similar bug in another protocol, adding that the error “has been exploited in like a dozen other protocols already.”"
https://twitter.com/Mudit__Gupta/status/1422797923037814786
https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million
A bug in Popsicle Finance allowed hackers to drain one of the DeFi protocol’s key products for roughly $25 million.
"Popsicle Finance, a multi-chain yield-generating crypto project, has melted under the heat of a new exploit.
The $25 million heist was revealed by security researcher Mudit Gupta, who said “the hack was complex but the bug was simple.” In a Twitter thread, Gupta also explained how he reported a similar bug in another protocol, adding that the error “has been exploited in like a dozen other protocols already.”"
https://twitter.com/Mudit__Gupta/status/1422797923037814786
The Popsicle Finance team offered the hacker who carried out the attack a reward, or rather a ransom for the return of the stolen funds in the amount of $1,000,000 in any currency at his request, I don't know how much this can help.
Quote from: https://popsiclefinance.medium.com/popsicle-finance-post-mortem-after-fragola-hack-f45b302362e0
Quote
So, now what?
First of all, we would like to address the black hat hacker. Although this may be a long shot we are offering a completely clean $1,000,000 bounty paid in whatever currency he/she likes if funds are returned.
First of all, we would like to address the black hat hacker. Although this may be a long shot we are offering a completely clean $1,000,000 bounty paid in whatever currency he/she likes if funds are returned.
During the last few weeks I was wrapping my head around finding all the DeFi hacks happened but google wasn't really helping. I said to myself, jeez why don't I go to the forum and search there.
Thanks a lot zasad@ this is what I was looking for!
I'll contribute to this thread in case I'll find some more news.
Thanks a lot zasad@ this is what I was looking for!
I'll contribute to this thread in case I'll find some more news.
Popsicle Finance- 25M
https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million
A bug in Popsicle Finance allowed hackers to drain one of the DeFi protocol’s key products for roughly $25 million.
"Popsicle Finance, a multi-chain yield-generating crypto project, has melted under the heat of a new exploit.
The $25 million heist was revealed by security researcher Mudit Gupta, who said “the hack was complex but the bug was simple.” In a Twitter thread, Gupta also explained how he reported a similar bug in another protocol, adding that the error “has been exploited in like a dozen other protocols already.”"
https://twitter.com/Mudit__Gupta/status/1422797923037814786
https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million
A bug in Popsicle Finance allowed hackers to drain one of the DeFi protocol’s key products for roughly $25 million.
"Popsicle Finance, a multi-chain yield-generating crypto project, has melted under the heat of a new exploit.
The $25 million heist was revealed by security researcher Mudit Gupta, who said “the hack was complex but the bug was simple.” In a Twitter thread, Gupta also explained how he reported a similar bug in another protocol, adding that the error “has been exploited in like a dozen other protocols already.”"
https://twitter.com/Mudit__Gupta/status/1422797923037814786
A new hacker attack, already the second in a week, on THORChain today led to a loss of $8 million, as the developers explained, the hacker said that he could have spent more( ETH,BTC,LYC, BNB and other BEP20s tokens), but eventually requested a reward of 10% of the amount of assets under potential threat in exchange for a critical error message.
THORChain lost, according to preliminary estimates 4,000 ETH about $8 million as a result of a hacker attack. Originally reported loss of 13,000 ETH. https://www.runebase.org/news/thorchain-suffers-exploit
They promise to inform the affected users about the details and compensation in the near future. https://twitter.com/THORChain/status/1415813696857591813
UPD: Official update from the THORChain team in the telegram channel https://t.me/thorchain_org
Yes, exactly it happened and was officially announced from their team. Their big response.They promise to inform the affected users about the details and compensation in the near future. https://twitter.com/THORChain/status/1415813696857591813
UPD: Official update from the THORChain team in the telegram channel https://t.me/thorchain_org
Quote from: https://t.me/thorchain_org/323674
MCCN Exploit Update
Loss:
Approx ~$4.9mm USD was taken in the exploit, far less than the intitial figures posted earlier. A granular breakdown is being developed by the community.
Method:
ETH Bifrost was tricked using a custom wrapper to read a deposit amount of 200 when it was actually zero. More details will be provided in the upcoming post mortem blog.
Discovery:
The issue was discovered by a community dev and anonymous nodes voluntarily used make halt command to stop their nodes. Once more than 1/3rd nodes had been halted, the network itself was halted. This was a decentralized action taken by node operators to protect the network.
Recovery:
1. Release the patch & restart the network > block pending outbounds > restore solvency.
2. Donate funds back to the ETH pool to restore lost funds to LPs
3. Release auto-solvency checker as a future preventative measure
4. Continue working with security firms to audit.
This is a disappointing moment for all, but LPs and Nodes should be unaffected after all is recovered (the funds will be restored). The network will be stronger and more resilient.
The THORChain community appreciate the inflow of support. More info to come in due course.
Loss:
Approx ~$4.9mm USD was taken in the exploit, far less than the intitial figures posted earlier. A granular breakdown is being developed by the community.
Method:
ETH Bifrost was tricked using a custom wrapper to read a deposit amount of 200 when it was actually zero. More details will be provided in the upcoming post mortem blog.
Discovery:
The issue was discovered by a community dev and anonymous nodes voluntarily used make halt command to stop their nodes. Once more than 1/3rd nodes had been halted, the network itself was halted. This was a decentralized action taken by node operators to protect the network.
Recovery:
1. Release the patch & restart the network > block pending outbounds > restore solvency.
2. Donate funds back to the ETH pool to restore lost funds to LPs
3. Release auto-solvency checker as a future preventative measure
4. Continue working with security firms to audit.
This is a disappointing moment for all, but LPs and Nodes should be unaffected after all is recovered (the funds will be restored). The network will be stronger and more resilient.
The THORChain community appreciate the inflow of support. More info to come in due course.
This is unfortunate because not only does it cause loss to investors and the project's confidence, but it also covers this negativity on the entire market, which is already in a bad state.
Quote
Safe Dollar - $250 000
https://t.me/safedollarannouncements/42
SafeDollar has been under attack. We have paused activities on SafeDollar and investigating the matter.
I still haven't forgotten the crazy moment with Titan, even though they later announced their mistake but it did a lot of damage. I've given up on polygons for now.https://t.me/safedollarannouncements/42
SafeDollar has been under attack. We have paused activities on SafeDollar and investigating the matter.
Bondly Finance Suffers Latest DeFi Attack, Token Price Tanks
https://beincrypto.com/bondly-finance-suffers-latest-defi-attack/
“Unfortunately we have been compromised by an unknown party. We would like to take this time to advise you to STOP TRADING BONDLY. Rest assure we have already taken action and will be operating as usual ASAP,”
Around an hour or so before the warning, DeFi Prime posted details of the address involved in the reported exploit.
unfortunately i have some Bondly in my gate.io account , personally i am not hear this news because i am prepare and accept the risk if someday it will be scam or anything else happen. But if i see the update from developers team , they have good response to issue policy so investors not worry and even thingking they will run. hopefully new token released soon and everything back to normal again. https://beincrypto.com/bondly-finance-suffers-latest-defi-attack/
“Unfortunately we have been compromised by an unknown party. We would like to take this time to advise you to STOP TRADING BONDLY. Rest assure we have already taken action and will be operating as usual ASAP,”
Around an hour or so before the warning, DeFi Prime posted details of the address involved in the reported exploit.
Bondly Finance Suffers Latest DeFi Attack, Token Price Tanks
https://beincrypto.com/bondly-finance-suffers-latest-defi-attack/
“Unfortunately we have been compromised by an unknown party. We would like to take this time to advise you to STOP TRADING BONDLY. Rest assure we have already taken action and will be operating as usual ASAP,”
Around an hour or so before the warning, DeFi Prime posted details of the address involved in the reported exploit.
https://beincrypto.com/bondly-finance-suffers-latest-defi-attack/
“Unfortunately we have been compromised by an unknown party. We would like to take this time to advise you to STOP TRADING BONDLY. Rest assure we have already taken action and will be operating as usual ASAP,”
Around an hour or so before the warning, DeFi Prime posted details of the address involved in the reported exploit.
THORChain lost, according to preliminary estimates 4,000 ETH about $8 million as a result of a hacker attack. Originally reported loss of 13,000 ETH. https://www.runebase.org/news/thorchain-suffers-exploit
They promise to inform the affected users about the details and compensation in the near future. https://twitter.com/THORChain/status/1415813696857591813
UPD: Official update from the THORChain team in the telegram channel https://t.me/thorchain_org
They promise to inform the affected users about the details and compensation in the near future. https://twitter.com/THORChain/status/1415813696857591813
UPD: Official update from the THORChain team in the telegram channel https://t.me/thorchain_org
Quote from: https://t.me/thorchain_org/323674
MCCN Exploit Update
Loss:
Approx ~$4.9mm USD was taken in the exploit, far less than the intitial figures posted earlier. A granular breakdown is being developed by the community.
Method:
ETH Bifrost was tricked using a custom wrapper to read a deposit amount of 200 when it was actually zero. More details will be provided in the upcoming post mortem blog.
Discovery:
The issue was discovered by a community dev and anonymous nodes voluntarily used make halt command to stop their nodes. Once more than 1/3rd nodes had been halted, the network itself was halted. This was a decentralized action taken by node operators to protect the network.
Recovery:
1. Release the patch & restart the network > block pending outbounds > restore solvency.
2. Donate funds back to the ETH pool to restore lost funds to LPs
3. Release auto-solvency checker as a future preventative measure
4. Continue working with security firms to audit.
This is a disappointing moment for all, but LPs and Nodes should be unaffected after all is recovered (the funds will be restored). The network will be stronger and more resilient.
The THORChain community appreciate the inflow of support. More info to come in due course.
Loss:
Approx ~$4.9mm USD was taken in the exploit, far less than the intitial figures posted earlier. A granular breakdown is being developed by the community.
Method:
ETH Bifrost was tricked using a custom wrapper to read a deposit amount of 200 when it was actually zero. More details will be provided in the upcoming post mortem blog.
Discovery:
The issue was discovered by a community dev and anonymous nodes voluntarily used make halt command to stop their nodes. Once more than 1/3rd nodes had been halted, the network itself was halted. This was a decentralized action taken by node operators to protect the network.
Recovery:
1. Release the patch & restart the network > block pending outbounds > restore solvency.
2. Donate funds back to the ETH pool to restore lost funds to LPs
3. Release auto-solvency checker as a future preventative measure
4. Continue working with security firms to audit.
This is a disappointing moment for all, but LPs and Nodes should be unaffected after all is recovered (the funds will be restored). The network will be stronger and more resilient.
The THORChain community appreciate the inflow of support. More info to come in due course.
~
Why Defi hack is so easy to do compared to others. I think there is something wrong with the Defi platform security system. We need to be careful with new and untested platforms. Hackers are always trying to attack new platforms, and they often succeed. As happened in BSC recently.
Hackers Stole $3.8 Billion in Cryptocurrency Hacks in 2020
Check out the statistics. Hackers hack anything they can hack: exchanges, wallets, projects. Defi projects are not on the 1st place in this list.
You need to be careful everywhere
___
Safe Dollar - $250 000
https://t.me/safedollarannouncements/42
SafeDollar has been under attack. We have paused activities on SafeDollar and investigating the matter.
https://twitter.com/RugDocIO/status/1409365551630090243?
SafeDollar may have been exploited for $250k in USDC and USDT‼️
Here is the exploiting contract :
https://polygonscan.com/address/0xc44e71debf89d414a262edadc44797eba093c6b0#tokentxns
ChainSwap- - $8M
https://cryptobriefing.com/8-million-lost-major-chainswap-exploit/
$8 Million Lost in Major ChainSwap Exploit
Chris Williams(C)
"Several tokens have plummeted after ChainSwap suffered its second exploit in eight days. The losses amount to roughly $8 million.
Key Takeaways
ChainSwap suffered an exploit last night, resulting in $8 million worth of losses.
The attacker sold several tokens available on the protocol through decentralized exchanges, meaning they tanked in value.
ChainSwap has paused its Ethereum to Binance Smart Chain bridge and pledged to airdrop new ASAP tokens to holders."
[moderator's note: consecutive posts merged]
~
Why Defi hack is so easy to do compared to others. I think there is something wrong with the Defi platform security system. We need to be careful with new and untested platforms. Hackers are always trying to attack new platforms, and they often succeed. As happened in BSC recently.
Impossible finance- $500 000
https://decrypt.co/74105/binance-smart-chain-defi-project-impossible-finance-hacked
Binance Smart Chain DeFi Project Impossible Finance Hacked
Yet another DeFi project on the Binance Smart Chain has been exploited. This time, attackers nabbed $500,000 from Impossible Finance in a flash loan attack.
https://twitter.com/Mudit__Gupta/status/1406878176509194246?
Impossible finance got exploited today for $500k.
Impossible Finance exploit root cause analysis
https://watchpug.medium.com/impossible-finance-exploit-root-cause-analysis-ba0ed7c151e4
https://decrypt.co/74105/binance-smart-chain-defi-project-impossible-finance-hacked
Binance Smart Chain DeFi Project Impossible Finance Hacked
Yet another DeFi project on the Binance Smart Chain has been exploited. This time, attackers nabbed $500,000 from Impossible Finance in a flash loan attack.
https://twitter.com/Mudit__Gupta/status/1406878176509194246?
Impossible finance got exploited today for $500k.
Impossible Finance exploit root cause analysis
https://watchpug.medium.com/impossible-finance-exploit-root-cause-analysis-ba0ed7c151e4
@Daltonik. I am skeptical that ddos was the cause. How can a ddos attack cause a token to pump to $60 then dump to $0? I reckon that it might be some mechanism in these dollar pegged stablecoins that when whales dump IRON, it also triggers to mint TITAN and removes liquidity to keep the peg of IRON to $1.00.
Yes, you are right, of course, everything can happen here, while there is no data on this case, what it was specifically, I think after some time there will be an analysis, it also happens that initially smart contracts of projects involve fraud schemes, such as the recent case with Beetsfarm Finance. https://twitter.com/RugDocIO/status/1405673057381978113
@Daltonik. I am skeptical that ddos was the cause. How can a ddos attack cause a token to pump to $60 then dump to $0? I reckon that it might be some mechanism in these dollar pegged stablecoins that when whales dump IRON, it also triggers to mint TITAN and removes liquidity to keep the peg of IRON to $1.00.
Iron Finance announced on Twitter, addressing users about the need to withdraw all liquidity from all pools, the details promise to report later, apparently the Poligon network was subjected to a ddos attack, as a result of which the price of the Titan token fell from $60 to 0. https://twitter.com/IronFinance/status/1405320650202419202
@slaman29. All 8 flashloan attacks? I disagree. These are not rugpulls. It appears to be a well organized group exploiting weaknesses in copy/paste projects deployed in Binance smartchain.
Also, I was wrong in my assumption that Binance smartchain would be the Ethereum killer hehe. However, Solana might be the Binance smartchain killer hehehehe.
Also, I was wrong in my assumption that Binance smartchain would be the Ethereum killer hehe. However, Solana might be the Binance smartchain killer hehehehe.
Ah sorry, I always assumed all kinds of attacks are called rug pulls in Defi. Just read it up now and rugpulls are when the project owners take out all the liquidty from the pool so yes, different mode of attack but in my book, still the same scummy people and like you said, probably all the same groups of people in the end.
Solana BSC killer? SOL starter looks almost sold out:)
@slaman29. All 8 flashloan attacks? I disagree. These are not rugpulls. It appears to be a well organized group exploiting weaknesses in copy/paste projects deployed in Binance smartchain.
Also, I was wrong in my assumption that Binance smartchain would be the Ethereum killer hehe. However, Solana might be the Binance smartchain killer hehehehe.
Also, I was wrong in my assumption that Binance smartchain would be the Ethereum killer hehe. However, Solana might be the Binance smartchain killer hehehehe.
Also, all of the other attacks are targetted towards Binance smart chain only. The skeptical me thinks that someone might be playing dirty. Solana to top 3 in coinmarketcap.com might prove this hehehehe.
I really hope someone goes and collects all this evidence and then tries to pin down these guys. My personal belief is that they aren't hackers but all are inside job developers with malicious intent, possibly installing loopholes made known the attackers. And then rugpulling at will. Binance Smart Chain only makes me think this for sure. Crime pays in crypto because enforcement doesn't come and catch them.
It seems they encourage people to take big risk on the so called DeFi(Decentralized Finance). You can't build a project today without proper/thorough testing before allowing the public to invest what they likely can't afford to risk/lose.
I have previously suggested opening up the DeFi platform to the public so anyone can help review projects based on list of Rules/Standards/Principles that have to be followed before a project is allowed for serious usage. Hope they don't prefer the platform to be takeover and regulated by central authorities.
Bitcoin didn't start with founders requesting people to invest huge amount of money or stake to be part of the network, help secure and keep it decentralized ... it instead paid participants... so that they risk less during its early stage and people probably began to put in money above sensible limits over time as security improves
Explore this reportI have previously suggested opening up the DeFi platform to the public so anyone can help review projects based on list of Rules/Standards/Principles that have to be followed before a project is allowed for serious usage. Hope they don't prefer the platform to be takeover and regulated by central authorities.
Bitcoin didn't start with founders requesting people to invest huge amount of money or stake to be part of the network, help secure and keep it decentralized ... it instead paid participants... so that they risk less during its early stage and people probably began to put in money above sensible limits over time as security improves
Hackers Stole $3.8 Billion in Cryptocurrency Hacks in 2020
https://decrypt.co/54128/hackers-stole-3-8-billion-in-cryptocurrency-hacks-in-2020
"Crypto wallets had 27 attacks and were the most lucrative target for the hackers, with $3.03 billion in losses."
__
With the market correcting, the volume of liquidations in Venus' Binance Smart Chain (BSC) -based Venus DeFi Landing Protocol reached $ 200 million.
https://forklog.com/v-protokole-venus-na-baze-binance-smart-chain-proizoshli-likvidatsii-na-200/
Venus Incident Report — XVS Liquidations
https://blog.venus.io/venus-incident-report-xvs-liquidations-451be68bb08f
https://twitter.com/FrankResearcher/status/1394900186435096578?
"Today we have witnessed the manipulation of XVS price — the governance token of Venus Protocol on BSC.
This incident resulted in $200M+ DeFi liquidations and a $100M+ of protocol bad debt.
As usual, let’s analyze this situation below👇"
It also appears that the manipulation on Venus and the flash loan attack was an inside job according to this article.
In this article below I will provide evidence from the blockchain that the Venus/Swipe team are directly linked to the Cannon Ignition Sale incident and the blockchain wallet responsible for causing the recent XVS account liquidations.
Source https://medium.com/@venus.insider/venus-io-disclosure-an-inside-job-f8ef195fe78d
Also, all of the other attacks are targetted towards Binance smart chain only. The skeptical me thinks that someone might be playing dirty. Solana to top 3 in coinmarketcap.com might prove this hehehehe.
Jump to: