Exactly Protocol hacked for at least $12 million

The Exactly Protocol, an attempt to "decentralize the credit market" built on the Optimism layer-2 network, was exploited. The protocol announced a pause to investigate a security issue, after they were alerted to suspicious transactions.

An attacker has siphoned more than 7,160 ETH (~$12 million) from the project, which they've bridged back to the Ethereum main chain. The Exactly Protocol's TVL plunged from $37 million to under $12 million following the attack.

Exactly writes on their website that they had been audited by four different firms: Chainsafe, Coinspect, ABDK, and Cryptecon.

Fed issues cease and desist to FTX-connected Farmington State Bank

A small building with "BANK" written over the doorFarmington State Bank (attribution)
Farmington State Bank, also known as Moonstone Bank, is a tiny Washington state bank that drew scrutiny after the FTX collapse for receiving an outsized investment from the firm. The investment appeared to be an attempt by FTX to gain control of a US bank, and raised questions over how the purchase was approved by federal regulators.

Now, the Federal Reserve Board has issued a cease and desist to Farmington State/Moonstone, claiming they have violated the commitments they made while going through the approval process. Despite promises not to do so, the bank engaged in digital asset activity, reportedly working with stablecoin issuers.

Blockchain Capital co-founder loses $6.3 million in SIM swap hack

Blockchain Capital co-founder Bart Stephens has filed a lawsuit against as-yet-unknown individuals who he says stole $6.3 million in cryptocurrency from him. The attackers used a SIM swap attack to gain access to his crypto wallet, which they then drained of various tokens.

The attackers also tried to steal around 80 BTC and 6,500 ETH (currently worth over $12.6 million) from a cold wallet belonging to Stephens, but were thwarted by an email alert sent to Blockchain Capital employee.

$1.7 million rendered inaccessible for weeks in broken bridge to new Shibarium network

People were very excited when the Shiba Inu-focused "Shibarium" layer-2 Ethereum blockchain went live on August 16. The dog-themed network is part of a push to make Shiba Inu a "serious blockchain project" — though the network will use $BONE, $TREAT, $SHIB, and $LEASH tokens, and is still fundamentally based around a dog meme.

A bridge between Ethereum and the Shibarium network was released as the network went live, and eager users quickly transferred a combined 954 ETH (~$1.7 million) to the bridge contract so they could access it on the new chain. However, users started reporting that transactions were stalled, and they weren't able to access their tokens on the Shibarium side.

The team quickly shut down conversation on Discord as more issues were raised, and claimed in a blog post that the issues were caused by nothing more than the network being overwhelmed with traffic. The team denied the authenticity of screenshots of a Telegram chat appearing to show the lead developer writing that the funds were unrecoverable, insisting they were safe.

Finally, weeks after the botched launch, Shibarium re-enabled the bridge and told users they could once again access their funds. Though there have been some delays in transactions, the "stuck" funds appear to be retrievable.

SwirlLend rug pulls for around $460,000

Despite the fact that Coinbase's Base blockchain was only officially launched a week ago, and a relatively small amount of funds are locked on the chain, it's already racking up its own tally of scams and hacks.

SwirlLend was a lending protocol operating on both Base and the similarly newborn Linea chain. Shortly after its launch, the project drained a combined $460,000 from the two chains, then deleted its social media accounts.

Shenzhen Shikongyun Technology accused of $83 million Filecoin pyramid scheme

Shenzhen Shikongyun Technology, a company focused on mining the Filecoin token, has been accused of running a pyramid scheme. Four of the company's executives were also charged. According to Chinese law enforcement, they had been soliciting investments in what was ultimately a pyramid scheme, exaggerating the likely returns from their mining efforts.

Shenzhen Shikongyun Technology was operating in mainland China despite a ban on cryptocurrency activities in September 2021.

Prime Trust files for bankruptcy

After the Nevada Financial Institutions Division issued a cease and desist describing Prime Trust as insolvent in June, then successfully requested the company be placed into receivership days later, it's no huge surprise that Prime Trust has filed for bankruptcy.

Prime Trust is a crypto custodian that previously served companies including Binance US, Swan Bitcoin, and BitGo. Just a year ago, the company announced they had raised $100 million in a Series B funding round, and planned to add crypto retirement accounts to its list of products. It's probably a good thing that didn't pan out.

According to bankruptcy documents, Prime Trust has between $50 million and $100 million in assets, but between $100 million and $500 million in liabilities. They report having between 25,000 and 50,000 creditors.

RocketSwap exploited after key compromise

Exploiters stole around 471 ETH (~$857,000) from the RocketSwap project on the Base Ethereum layer-2 blockchain. According to RocketSwap, the project had stored private keys on a server which was then hacked via brute force. "We are very sorry for your loss," they wrote on Twitter.

RocketSwap later announced a plan to airdrop tokens to "compensate" users for the theft. They also tried to reassure projects that were migrating away from RocketSwap that there was "no need to run away, your funds are safe".

Zunami Protocol exploited for more than $2.1 million

The Zunami Protocol stablecoin-focused yield farming aggregator was exploited for more than $2.1 million when an attacker was able to perform a price manipulation attack on the project's primary pool. Zunami attracted users by promising "the highest APY on the market": around 14%. The project had been audited by Ackee and HashEx.

The attack was a "classic price manipulation" exploit, according to the Ironblocks security firm. The attacker was able to steal 1,152 ETH ($2.13 million) from the protocol. They then tumbled the stolen funds through Tornado Cash.

Uniswap developer fired over FrensTech rug pull

After pulling off a rug pull that only netted 14 ETH (~$25,900), Allen Lin (known as AzFlin) lost his day job for the company that maintains the Uniswap DEX. Hope it was worth it.

Lin had created a project called "FrensTech", which aimed to capitalize on the popularity of a product called "friends.tech", and which ultimately accumulated the 14 ETH in fees before he decided to drain liquidity. Lin had not tried to conceal his identity. After the rug pull, Uniswap founder Hayden Adams wrote on Twitter: "Wanted to let people know this person is no longer with the company. Not behavior we support or condone."

Lin was unapologetic, tweeting: "got fired from uniswap, but gained 600 new followers and [crypto Twitter] villain status. net neutral tbh".

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.