In the most recent hack, around $7 million was stolen as attackers discovered a vulnerability in the contracts of the DEI token. Some of the attackers were apparent whitehats, who executed the exploit to safeguard the funds until they could be returned to a secure address. As of May 8, $5.5 million of the $7 million stolen had been returned.
Deus Finance suffers third hack
Deus Finance suffered yet another hack as around $7 million was taken from the protocol. This was not the first time the platform had been targeted, suffering a $3 million exploit in March 2022 and a $13.4 million exploit in April 2022. Then, in May 2022, Deus Finance's algorithmic stablecoin lost its intended dollar peg in the wake of the Terra collapse and never recovered.
Xirtam rug pulls
A project called Xirtam, built on the Arbitrum blockchain, raised 1,909 ETH (~$3.2 million) in several fundraising rounds in April 2023. Then, on May 4, the project rug pulled. Founders drained the funds from the project, then deposited them into Binance. This turned out to have been a huge mistake for them, as Binance was able to freeze the stolen assets.
On September 6, Binance announced that they were working to return the frozen 1,909 ETH to the people who had purchased it in the funding rounds.
WallStreetBets coin tanks 90% after insider dumps holding
WallStreetBets is a subreddit that became popular during the pandemic-fueled everyone-should-become-a-daytrader era, and is known for its memestocks and its users who often make enormously risky gambles on the stock market. The only surprise to me in this particular incident is that it took this long for them to rally around a crypto token, because it's a match made in heaven.
The WSB coin launched as an "official memecoin of r/wallstreetbets". The whitepaper explains the token allocation, saying that "It's the fairest launch memecoin you will find with no team allocation and no presale. Just a free airdrop and some coins for the community. 10% of the $WSB supply is reserved as a treasury for the r/wallstreetbets sub to do with as they please. I’m sure they will spend it wisely and definitely not waste it gambling or convincing each other to drink their own urine." Compelling!
The token launched, and quickly achieved a $50 million "market cap". However, on May 3 the token suddenly lost 90% of its value as one of the token creators, "zjz", dumped a massive quantity of the tokens allocated to the team, trading them for 334 ETH (~$635,000).
zjz has claimed that he only sold the tokens because another creator — "WSBMod" — was secretly draining the token by creating huge airdrops and then claiming them for himself. WSBMod, on the other hand, claims that zjz's actions were theft, and has threatened to involve the police and FBI.
Crypto sleuth zachxbt has since gotten involved in the fray, and along with another prominent crypto figure has joined a multi-sig wallet to try to help secure the funds' return without giving any of the creators involved in the dispute unilateral control.
Former OpenSea executive convicted of fraud and money laundering in NFT insider trading case
Nate Chastain, the former Head of Product for the popular OpenSea NFT marketplace, was convicted by a jury of fraud and money laundering for illegally profiting from his insider knowledge of which NFTs would be featured on the site. The two charges each carry a maximum sentence of twenty years in prison.
Chastain was asked to resign by OpenSea in September 2021 after a Twitter user discovered apparent evidence that he had been engaging in insider trades. He was arrested and charged with money laundering in June 2022.
Chastain unsuccessfully argued in his defense that information about which NFTs would be prominently featured on OpenSea wasn't insider knowledge, and "nobody told Nate that he couldn't use or share that information". However, prosecutors argued that attempt to use anonymous accounts to make the trades suggested that he knew what he was doing was wrong.
This case has been described as the first NFT-related insider trading case, and could set a precedent for other similar charges.
OKX suddenly drastically limits withdrawals for users who haven't completed KYC
As regulatory groups have started to pay more attention to crypto platforms, it hasn't been terribly unusual to see them tighten their identification requirements — particularly for customers engaging in high-value transactions. However, the Seychelles-based OKX exchange suddenly and without warning implemented a $5,000 total withdrawal limit for users of its crypto exchange that hadn't provided detailed identification (KYC), leaving some users who were unwilling to provide such identification with large sums of crypto assets trapped on the exchange. Previously, users who had submitted only the base level of identification were able to deposit or withdraw $50,000 per day. These users weren't notified of the change, even when they deposited funds, and only discovered the new limit when they went to withdraw or heard about it on social media.
It's not clear when precisely the change went into effect, but reports of the limitation began appearing in April 2023.
Crypto is the end of Storybook Brawl
Storybook Brawl, a card based autobattler game that was beloved by Sam Bankman-Fried, took its servers offline on May 1. The game had no connection to the crypto industry until its studio was acquired by FTX Ventures in March 2022. This was not taken well by its existing playerbase, who left a flood of negative reviews on Steam based on the developers' intentions to incorporate cryptocurrencies and NFTs. According to SBF, Storybook Brawl was going to be "the vanguard for the ethical integration of gaming and crypto transactions."
The end of FTX seems to have directly spelled the end of Storybook Brawl, which stopped announcing updates in November. However, Protos has pointed out that the game may likely be auctioned off as a part of FTX bankruptcy proceedings.
CZ smacks down Justin Sun for trying to game SUI airdrop
"Binance LaunchPool are meant as air drops for our retail users, not just for a few whales," tweeted Changpeng "CZ" Zhao, the CEO of Binance, after seeing an alert showing that Justin Sun had transferred $56 million to Binance. "LaunchPool" is a process in which Binance users can farm various tokens — now including SUI — and receive rewards. "Our team told Justin, if he uses any of these to grab the LaunchPool Sui token, we will 'take action against it'. SMH." wrote CZ.
Indeed, it later turned out that Sun's team had farmed around 279,000 SUI (SUI does not yet have a reliable dollar price because it is set to launch later this month). Sun blamed the event on a TUSD market maker, writing, "Regrettably, some of our team members were not fully aware of the intended purpose for these funds and inadvertently used a portion of them to participate in exchange campaigns. Upon realizing this error, we immediately contacted the exchange team and arranged for a full refund of the funds." Those replying to his comment seemed more than a little skeptical that the incident was truly a mistake.
Level Finance exploited for ~$1.1 million
The Level Finance decentralized perpetual exchange was exploited after an attacker discovered a vulnerability in one of the project's smart contracts. They were able to drain 214,000 LVL tokens, which they swapped to 3,345 BNB ($1.1 million). The contract had been audited by Obelisk and Quantstamp, but neither firm apparently discovered the vulnerability.
The attack caused the LVL token to drop substantially in price, plunging from around $9.00 to as low as $4.20 before recovering to around $7 — a loss of 22%.
Poloniex pays $7.6 million settlement for sanctions violations
A US entity that previously controlled the Poloniex crypto exchange has agreed to pay a $7.6 million fine to settle allegations that it violated US sanctions against Crimea, Cuba, Iran, Sudan, and Syria. The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) alleges that between January 2014 and November 2019, Poloniex allowed citizens in those jurisdictions to use the platform, despite knowing their locations thanks to KYC and IP address information. OFAC alleges that there were nearly 66,000 apparent sanctions violations, which amounted to more than $15 million in transactions.
Poloniex was a US-based crypto exchange founded in 2014, which in 2018 was purchased by Circle, who intended to get rid of the illegal activity for which it was known. However, when they discovered that the customers who used Poloniex no longer wanted to use it once they were subjected to scrutiny, they sold the platform to Justin Sun in late 2019, who relocated it to the Seychelles and shut down US operations. It appears that the OFAC fine will apply to the US entity most recently controlled by Circle, and not to Justin Sun's operation.
In August 2021, Poloniex also paid more than $10.3 million to settle allegations from the U.S. Securities and Exchange Commission that it had operated as an unlicensed exchange.
Individuals lose millions in "permit phishing" scams
Between March and April 2023, the Scam Sniffer organization has identified at least $7.7 million stolen by so-called "permit phishers". These attackers convince their victims to sign malicious crypto transactions that use the "permit" functionality, which allows the attackers to siphon funds from the crypto wallets. This type of attack has existed for over a year, but there have been some high-value instances of the attack lately.
On March 11, ScamSniffer tweeted that they had detected 162 instances of the scam, totaling almost $4 million stolen, over the prior two days. On March 24, an individual wallet lost $4 million. Similar attacks on April 19, April 21, and April 30 saw individual wallets lose $449,000, $1.04 million, and $2.28 million, respectively.