This isn't the first security breach to tarnish 3Commas' reputation. In October 2022, customers reported losing a significant amount of assets in what 3Commas first tried to blame on phishing websites resembling FTX. 3Commas months later owned up to the fact that their database had been compromised, and that API keys were leaked.
3Commas suffers another security breach
3Commas, a crypto trading bot provider, suffered another security breach in which some customer wallets were used to make unauthorized trades. They haven't disclosed how much in assets were lost.
UK's Financial Conduct Authority warns of Huobi and KuCoin
The United Kingdom's Financial Conduct Authority (FCA) has added another 146 entries to its "warning list" of unauthorized firms, including the crypto exchanges Huobi and KuCoin. The additions pertained to new regulations that require crypto firms who want to run promotions in the country to register with the FCA, and comply with regulations aiming to prevent misleading advertisements.
The warning list was created to notify potential users of these firms, and to inform them that losses related to the use of those platforms won't be covered by the UK's compensation scheme.
Huobi has claimed they don't operate or promote in the UK, while KuCoin gestured towards adjusting its practices in the UK. Firms on the warning list may be subjected to more serious enforcement actions in the future, including fines or even prison time.
Astrology-themed NFT project Lucky Star Currency rug pulls for $1.1 million
Lucky Star Currency was an NFT-focused project released by a group claiming to be made up of astrologists. The group was heavily promoted on Chinese news and Q&A platforms. However, not long after its release, the contract creator withdrew more than 1.6 million LSC tokens and swapped them for approximately $1.1 million.
Bitcoin mining hardware manufacturer Bitmain stops paying employees
Bitmain, the manufacturer of popular Bitcoin mining equipment (known as ASICs), is apparently in such dire financial straits that it can no longer pay employee salaries. Local media reported that all "bonuses and incentives" were nixed by the Beijing-based company, and the firm is considering cutting all wages by 50%. They also wrote a letter to employees, informing them that they would not be paying out September salaries until a review later in the month.
Stars Arena exploited for $3 million
Stars Arena, an Avalanche-based dupe of the popular Friend.Tech project, suffered a serious exploit in which an attacker drained tokens priced at around $3 million.
Avalanche co-founder and CEO Emin Gün Sirer drew widespread mockery when announcing that "the amount lost is only $3m", apparently not perceiving that $3 million is a massive sum to most people. He also didn't mention that it constituted almost the entire total TVL of the Stars Arena project, which was left with less than $1 in tokens following the attack.
Stars Arena was fortunate, in that the hacker ultimately contacted them offering to make a deal. The attacker returned 90% of the funds, keeping $300,000 as a "bounty".
THORSwap temporarily shuts down web interface as FTX hacker tries to launder $131 million
The THORSwap decentralized exchange has put its web interface into "maintenance mode" in hopes of thwarting the thief who stole over $400 million from the FTX exchange as it was mid-collapse in November 2022. Those funds have remained largely for almost a year, until the thief began moving funds recently — interestingly, coinciding with the start of Sam Bankman-Fried's criminal trial.
The attacker tried to launder around $131 million of the stolen assets by routing them through services including Railgun and THORSwap. After "consultation with advisors, legal counsel, and law enforcement", THORSwap decided to pause its web interface in hopes of making money laundering more challenging for the attacker — although the thief could still interact with the THORSwap smart contracts directly, if they so chose.
Some criticized THORSwap for apparently caving on its censorship-resistant, decentralized ethos. Others, however, saw the move as understandable given the THORSwap developers reside in the United States, which has recently cracked down on mixing services that facilitate the laundering of illicit funds.
Gitcoin loses $500,000 in transfer SNAFU
After agreeing to allocate $500,000 to "MMM" (merchandise, memes, and marketing — no, really), Gitcoin screwed up sending the money so badly that it's gone forever. Whoever was in charge of making the transfer accidentally pasted the Gitcoin contract address into the recipient field, rendering the tokens permanently inaccessible. Such mistakes can be devastating, and yet are very common in the crypto world, where transfers are irreversible.
Bored Apes' Yuga Labs lays off employees
Even the best known NFT brand can't escape the effects of a collapsing industry. Yuga Labs, the company behind the blue-chip Bored Apes NFTs and related collections, and the acquirers of collections including CryptoPunks, has announced that it will be joining the many other companies in the crypto world performing layoffs. They did not disclose how many employees would be losing their jobs.
"It's a challenging time, not only for our industry but also for the global economy," wrote Yuga Labs CEO, apparently hoping that people ignorant to the past year of disaster across the NFT industry might be willing to attribute Yuga Labs' struggles to macroeconomic forces and not the implosion of the crypto — and particularly NFT — world.
BigWhale loses $1.5 million in private key leak
The defi staking and lending project BigWhale announced that the private key to one of their crypto wallets had been leaked, and 7,200 BNB (~$1.5 million) had been stolen.
In a long post on Twitter, the project promised "we will refund all investor funds down to the last cent". They also wrote that "Not only are we going to use the fullest extent of the law to go after the person or persons behind this hack / attack, we will also use ALL OTHER MEANS NECESSARY - and we do have such resources at our disposal, to go after the ones who are behind this. (We work with assets within the Russian government directly...)"
In a later post on their website, however, they wrote that they do "not bear legal liability to refund investors for the losses incurred unless the hacked funds are successfully recovered", attributing the incident to force majeure. They repeatedly claimed that they had not been involved in the theft. The project completely took down its website, redirecting it to this post.
Crypto.com fined $3.1 million in the Netherlands for operating without registration
Crypto.com spent around two years operating in the Netherlands without bothering to register as required by the Dutch central bank — or pay the supervisory fees they were supposed to be paying. On October 2, 2023, the central bank imposed a €2.85 million (US$3.12 million) fine on the company for the period of unlicensed registration. The company had registered with the regulator in July of that year.
The fine was announced in March 2024, and Crypto.com said it had appealed the penalty.
Crypto.com was hardly the first exchange to fall afoul of the regulator: Binance was fined $3.35 million in July 2022 for the same, and Coinbase was hit with a $3.6 million for the same in January 2023. Binance later shut down their Dutch operations after failing to obtain a license.