Fake minting links distributed after several large NFT Discord servers are compromised

Members of several large NFT Discord servers began seeing suspicious-looking messages announcing supposed NFT mints that turned out to be fakes. Affected communities appeared to include Moonbirds/PROOF, Axie Infinity, RTFKT, Memeland, Alien Frens, and others. The attack appeared to involve a Discord bot called MEE6, though there was some confusion around whether there was a compromise of MEE6 itself or if it was simply used in the attack. The following day, MEE6 acknowledged that an employee account had been compromised.

Bot compromises have emerged as a wide attack vector in crypto and web3 communities, as widely-used bots can have elevated permissions across Discord channels used as official information sources across many communities.

Terraform Labs' legal team resigns

In what seems like a bad sign for Terraform Labs, the developer of the Terra blockchain and the TerraUSD (UST) and Luna cryptocurrencies, the three members of the company's legal team left the company. This came shortly after UST, Luna, and the entire Terra ecosystem dramatically collapsed after the stablecoin lost its peg last week.

Four pricey NFTs stolen from actor Seth Green, complicating his plans for an animated series

Portrait of Seth Green speaking into a microphoneSeth Green (attribution)
Actor Seth Green tweeted that he had been targeted with a phishing attack that resulted in the theft of four pricey NFTs: a Bored Ape, two Mutant Apes, and a Doodle. The thief quickly flipped three of the four NFTs for sale, netting 145.5 ETH (about $300,000).

The theft occurred on May 8, though Green only seemed to notice on May 17 when he tweeted, "Well frens it happened to me. Got phished and had 4NFT stolen."

The loss of the Bored Ape was later revealed to have put Green in a bit of a pickle, when he released the trailer for a new animated series he was developing that starred his pilfered primate. Given that BAYC ownership grants commercial usage rights (which are presumably transferred to the new owners when the NFT changes hands), the person who bought the NFT flipped by the phisher could have possibly brought a lawsuit against Green if he moved forward with the series.

Green ultimately spent about $300,000 to buy his ape back from the hacker.

American running "untraceable" service "designed to evade US sanctions" is charged after being traced

An unidentified US citizen transferred more than $10 million in Bitcoin to a cryptocurrency exchange in a "comprehensively sanctioned" country where they were running a payments platform. They advertised that transactions through the platform were untraceable, and described the platform as designed to evade U.S. sanctions. Despite this, law enforcement was able to obtain information from U.S. and foreign cryptocurrency exchanges — including KYC information provided by the individual — to help identify and trace the individual behind it.

Though the country is as yet unnamed, the limited number of countries sanctioned in the way described in the decision allow us to deduce that it was either Cuba, Iran, North Korea, Syria, or Russia. This case marked the D.O.J.'s first criminal prosecution involving alleged use of crypto to evade sanctions.

U.S. Magistrate Judge Zia M. Faruqui wrote in the opinion: "Virtual currency is traceable. Yet like Jason Voorhees the myth of virtual currency's anonymity refuses to die. See Friday the 13th (Paramount Pictures 1980)."

Scream lending protocol racks up $35 million in bad debt after hardcoding not-so-stablecoin prices to $1

The defi lending protocol Scream may have taken the "stable" in "stablecoin" a bit too literally when they hardcoded the prices of the Fantom USD (fUSD) and DEI stablecoins. In the past few weeks we've seen many stablecoins wobble, and when fUSD and DEI followed suit, Scream ended up in trouble. Users were able to take advantage of the inaccurately high price to borrow other stablecoins on the cheap, leaving Scream with $35 million in bad debt. The platform's reserves of other stablecoins were completely drained; meanwhile, Scream users holding fUSD or DEI can't withdraw.

CZ admits Binance held Luna and UST in bizarre tweet threads

On May 15, Binance CEO Changpeng Zhao (widely known as CZ) created a tweet thread in which he attempted to speak nonchalantly about questions that had "just occurred to [him]" about whether Binance held any UST. In the thread he attempted to distance himself from decisions or knowledge around such holdings, speaking cavalierly about how "we probably do have some". Former FBI agent James Harris wrote an interesting analysis of the thread, concluding, "If people weren't worried before, they will be now. If investigators weren't suspicious before, they should be now."

The following day, CZ tweeted, "Binance received 15,000,000 LUNA (at peak worth $1.6 billion USD, now not much) as part of the original ($3m) invest. 560x return at peak." In this tweet, "not much" glossed over the fact that these LUNA, obtained in return for a $3 million investment and at one point nominally worth $1.6 billion, are now worth $2,900.

He also wrote that Binance had 12,000,000 UST — worth $12 million when UST was properly pegged, and now worth $1.16 million (assuming liquidity exists to sell it at all).

Luna Foundation Guard reports what it did with its Bitcoin reserves, raising more questions

Many were eagerly awaiting a report from Luna Foundation Guard (LFG) on what happened to the several billion dollars' worth of Bitcoin reserves they once held, which they transferred during the UST collapse. The organization tweeted an explanation of the actions they took with those funds on May 16, describing how they began to convert Bitcoin to UST. They referred to transferring BTC and other reserves to "a counterparty", who traded them UST in exchange. They didn't name who these counterparties were.

More than a few people were unsatisfied with this reporting, asking more transparency around who these "counterparties" were. Ultimately, this action benefited the "counterparties", providing liquidity to these whales who were able to exit their now risky UST positions for a good price, and did not help most of the individuals holding UST.

"Stable"coin DEI loses peg

Another stablecoin lost its peg as dominoes continued to fall in the declining crypto market. DEI, an algorithmic stablecoin created by Deus Finance on the Fantom network, de-pegged on May 15. Intended to be pegged to the US dollar, the token dipped to a low of around $0.50, and continued to hover well below its intended price through the next day. DEI had a nominal market cap of more than $88 million before losing its peg.

This is another bump in the road for Deus Finance, which lost a total of $16.4 million in two separate flash loan attacks in March and April 2022.

Flash loan attacks on "Feed Every Gorilla" token take $1.9 million

A flash loan attack on the "Feed Every Gorilla" (FEG) token swap contracts pulled $1.3 million from the project, also tanking the token price by 80%. The project operates on both the Ethereum and BSC chains, and the attacker was able to use the exploit against the contracts on both networks. Shortly after the first attack, FEG was hit with a second flash loan attack that drained another $590,000 from the project.

Prior to these attacks, FEG had earned some notoriety from a May 2021 Vanity Fair article outlining an alleged pump-and-dump scheme, titled "Inside the Rise and Fall (and Rise and Fall) of Shit Coins". Despite the bad press, much of the FEG community maintained that the article was a smear and nothing more than an attempt by the author to create FUD. "You could literally take every token and this would apply to everyone..." wrote a moderator of the official FEG subreddit.

People continue to wait for a public accounting of what happened to Terra's $3.5 billion in Bitcoin reserves

Now that the dust is settling somewhat from the dramatic collapse of Terra, people are beginning to wonder when they'll hear more about what exactly happened to the 80,394 Bitcoin (priced at $3.5 billion at time of purchase; priced closer to $2.5 billion at the time of writing this entry) that previously belonged to Luna Foundation Guard (LFG). The project had previously purchased the assets to hold as reserves, and as UST began to lose its peg, LFG announced they would use those reserves to buy UST to help maintain the peg. Over the next few days, the reserves were emptied, but after they were moved to the Gemini exchange they became impossible to trace further. Although transactions are usually quite traceable on the blockchain, when funds are moved to services like the Gemini exchange, they become impossible to trace using public data because of how exchanges pool funds and transactions internally.

Terraform Labs CEO Do Kwon tweeted on May 13 that "We are currently working on documenting the use of the LFG BTC reserves during the depegging event. Please be patient with us as our teams are juggling multiple tasks at the same time." It's not clear when this documentation will be released. Binance CEO Changpeng Zhao joined the group of people asking about the BTC reserves, tweeting, "I would like to see more transparency from them. Much more! Including specific on-chain transactions (txids) of all the funds. Relying on 3rd party analysis is not sufficient or accurate."

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.