Despite his promises, Pinillo had created no trading platform whatsoever, was doing no crypto trading, and simply pocketed all the money. Any payments made to his customers during the fraud were taken from newer investors, in classic Ponzi fashion.
Former pastor charged with crypto scheme in which he stole $5.9 million from his former congregants
The CFTC has filed suit against Francier Obando Pinillo, an American former pastor who targeted his former congregants and other unsophisticated investors with a crypto pyramid scheme called "Solanofi". He promised victims that his supposed automated trading system was "risk free", and that they would earn guaranteed profits as high as almost 35% compounded monthly — which he "proved" to them with an online dashboard showing faked balances. They were also encouraged to recruit friends and family, and incentivized with referral fees.
- "CFTC Charges Washington State Pastor with Fraud, Misappropriation in Multilevel Marketing Scheme Targeting Hispanic Americans", US Commodity Futures Trading Commission [archive]
Clober gets clobbered
Clober, a DEX built on Coinbase's Base Ethereum layer-2, suffered an exploit only about a week after its launch. A re-entrancy bug in the project allowed an attacker to siphon 133.7 ETH (~$501,000) from the project. Although the project boasted of audits, Clober had made changes to a contract after the audits that introduced the vulnerability.
Clober has offered a 20% "bug bounty" to the exploiter vi on-chain message, though they have not yet received any public reply.
- "Clober Dex Incident Analysis", CertiK
Alpaca Finance proposes $50,000 restitution for $2.8 million in losses
Users of the Alpaca Finance lending protocol suffered losses when the protocol's sloppy oracle implementation finally resulted in consequences. Although many had warned the project about their glacial oracle setup, and the vulnerabilities they were opening themselves up to, the project repeatedly denied any issues and even banned those voicing concerns.
Then, when a new token called THENA was listed on Binance and experienced major volatility as trading opened, Alpaca's issues came to a head. As the token price surged, the slow oracle failed to reflect price changes, allowing people to withdraw far more THENA than they had posted as collateral. THENA lenders have lost an estimated $2.8 million.
On December 10, Alpaca Finance proposed distributing $50,000 "saved" by their liquidation bot to the lenders who had lost funds. Alpaca Finance also banned users complaining about their losses in the project Discord, dismissing them as a "group bot/FUD attack".
85-year-old painter loses life savings to NFT art dealer scam
An 85-year-old painter from Brooklyn was convinced to send scammers $135,000 after they promised they would sell his artwork as NFTs on OpenSea. After agreeing to have a supposed "art dealer" list and sell his artwork, the man was told he'd earned $300,000. But there was a catch: he would have to pay nearly half that amount in "fees" to get access to his windfall. The man liquidated his retirement, made credit card payments, and took out a personal loan to acquire cryptocurrency for the supposed fees, only to later realize he'd been duped.
Police were unable to recover his money, although they did seize around 40 websites that were spoofing various real NFT marketplaces.
- "Brooklyn District Attorney Shuts Down 40 Domains Associated With NFT Crypto Scam Targeting Artists, After Brooklyn Painter Lost Over $135,00", "Kings County District Attorney's Office" [archive]
"Hawk tuah" memecoin immediately crashes
Who could have guessed that buying up a token based around the long-past-its-expiration-date hawk tuah meme might turn out to be an unwise investment? Haliey Welch, the originator of the raunchy catchphrase, launched a memecoin that she insisted was not a cash grab but a "good way to interact with her fans". (The "interaction" in question here was limited to " fans give money", because she had no other specific plans for the token).
The token followed the typical pattern of quickly pumping, then crashing spectacularly, losing around 90% of its "value". This is often an indicator of a pump-and-dump scheme by insiders, but Welch vehemently denied such wrongdoing, blaming the crash on "snipers".
"I really lost $43k apeing in 'hawk tuah' coin," wrote one buyer on Twitter. Other Twitter users marveled at a wallet that swapped $1.4 million worth of MOODENG (a memecoin based on the tiny hippo of the same name) only to lose it all on the $HAWK token.
Official Solana JavaScript library compromised in supply chain attack, at least $184,000 taken
An attacker was able to compromise an account that had publish access for the official Solana web3.js library, which is widely used by dApps to read and write from the Solana blockchain. The library gets over 350,000 downloads per week from the popular JavaScript package manager npm.
Malicious versions of the library allowed exploiters to steal private keys and drain funds from dApps like various Solana bots.
Around $184,000 was stolen as a result of the compromise. Although it was caught fairly quickly, and the malicious code was removed from package managers, developers will need to update projects that used the malicious version of the library, and refresh any potentially exposed secrets.
- "Solana Web3.js library backdoored to steal secret, private keys", Bleeping Computer [archive]
Clipper DEX suffers $450,000 hack
The Clipper decentralized exchange suffered a $450,000 exploit across two Ethereum layer-2 chains. Although some speculated that the issue may have been a private key leak, Clipper denied this, and instead said that an attacker had exploited a feature allowing people to make withdrawals denominated in a single token by performing swaps along with the withdrawal.
Although the $450,000 theft is relatively small compared to some other crypto hacks, it represented around 6% of the total value locked on Clipper. Clipper stated they were working to trace and attempt to recover funds, and asked the hacker to contact them to potentially negotiate a return of some funds.
Crypto exchange XT.com suffers $1.7 million hack
On November 28, cryptocurrency exchange XT.com abruptly suspended withdrawals, citing a "wallet upgrade and maintenance". However, after a blockchain security firm identified $1.7 million in suspicious transfers, XT.com acknowledged that they had "detected an abnormal transfer from our platform wallet". According to an announcement, the stolen funds were company assets, rather than cryptocurrencies belonging to users.
13-year-old rug pulls crypto token, then faces retaliation
A 13-year-old known as the "Gen Z Quant kid," created a token called QUANT and executed a rug pull, making $30,000. In retaliation, various people in the cryptocurrency world executed a "revenge pump" — pumping up the price of the token after the kid cashed out, causing him to miss out on potential gains. Worse, they then found the child's identity, and published his address and the school he attended. They also identified his mother, and began leaving hateful comments on her Instagram account. Rumors also emerged that a member of the cryptocurrency community dognapped the child's dog, then launched a memecoin based on the animal.
Around $21 million in losses reported by users of DEXX
DEXX, a platform that advertises itself as the "first memecoins trading terminal application", disclosed that it had been hacked when it posted a message on social media addressed to "Mr./Ms. Hacker", asking they return stolen funds in exchange for "destroy[ing] all information we currently have on the hack" and not pursuing further legal action.
DEXX did not disclose how much was taken in the breach, but hundreds of victims have reported around $21 million in combined losses so far.