It's not clear yet how the attack was perpetrated, although crypto researcher Spreek reposted a comment by an admin in Fantom's Telegram channel, where they blamed the theft on a zero-day exploit in Google Chrome.
Fantom Foundation and employees lose collective $7 million in mass hack
An attack targeting the Fantom Foundation and its employees siphoned $7 million from wallets under their control. Of that, around $550,000 were funds belonging to the Fantom Foundation. One individual employee reportedly lost $3.4 million.
TrueUSD tries to claim no affiliation with tokens created by its deployer address, raising further questions
A new, Euro-pegged stablecoin called $TEURO emerged on October 13, with an initial supply of around €70 million. However, TrueUSD subsequently tweeted that "we have zero affiliation with it". The post warned people to "step back and refrain from risky investments".
However, the post raised only more questions, as the $TEURO token had been deployed by the address that deployed the primary TrueUSD token. This means that either TrueUSD is lying when they claim they're unaffiliated with $TEURO, or some of their private keys were compromised, allowing an unrelated party to deploy a contract appearing to belong to them.
Almost $100 million liquidated over false news of Bitcoin ETF approval
A post falsely announcing that the SEC had approved a spot Bitcoin ETF caused $100 million in liquidations as the market briefly surged on the news. $81 million in short positions were liquidated as Bitcoin shot up to $30,000 from just under $28,000, and another $31 million in long positions were liquidated as the news turned out to be false.
The post by crypto media outlet CoinTelegraph was based on a faked screenshot of what appeared to be the Bloomberg Terminal. The post quickly propagated through the crypto world before people began to question its veracity. CoinTelegraph later issued an apology, blaming the incident on a failure by employees to follow the normal editorial approval process.
This adds to the list of incidents that illustrate the extent to which false reporting by traditional or crypto media, or by influential personalities, can move crypto markets. Past incidents have included a crypto Twitter personality tweeting the false rumor that Interpol had issued a red notice for Binance CEO Changpeng Zhao, and two instances of token price spikes based on false press releases claiming major corporations would accept the tokens as payment.
- "Clarification on sharing false spot Bitcoin ETF news", CoinTelegraph [archive]
South Korean regulators allege Sui Foundation manipulated markets
A lawmaker in South Korea has alleged that the Sui Foundation has engaged in market manipulation to enrich themselves. The South Korean Financial Supervisory Service reportedly launched an investigation into the distribution of the SUI token following Representative Min Byeong-deok's allegations, intending to determine whether there was truth to his claims that they had paid themselves interest by staking tokens that should have been left untouched in the non-circulating supply.
The Sui Foundation has disputed the allegations on Twitter, calling them "unfounded and materially false".
Hackers host malicious code on Binance chain to circumvent takedowns
An otherwise very "web2" hack has taken on a web3 twist as hackers have started to store malicious code on the blockchain. Attackers first compromise WordPress websites, then show a screen to visitors telling them they need to update their browser to view the website. When the visitor does so, the site downloads malware which then harvests information like login credentials.
Attackers previously stored the malicious code on typical webhosting services, but those services began to take it down. Now, some have started using Binance's blockchain to store these payloads, taking advantage of the immutable nature of blockchains to prevent anyone from taking it down.
USDR stablecoin de-pegs
The real-estate-backed US dollar stablecoin "Real USD" (aka USDR) lost its peg, dropping from $1 to around $0.53. The website for the stablecoin was — even after the depeg — promising customers 16.39% yields.
The de-peg occurred amid a "liquidity crunch" as holders rushed to redeem their USDR for the DAI stablecoin, draining the project of its DAI reserves. The team behind the project, TangibleDAO, issued a statement stating that "the real estate and digital assets backing USDR still exist and will be used to support redemptions." However, despite their insistence that the problem is just a liquidity issue rather than a solvency one, a dashboard on their own website showed that the stablecoin isn't fully backed and has a deficit of around $3.4 million.
In a related incident, a trader trying to swap their $131,350 in USDR for the USDC stablecoin lost every penny of it when their transaction was arbitraged by a MEV bot.
Platypus Finance hacked for a third time this year
At this point, they should probably just have a form email ready to go. Platypus Finance has suffered a cumulative $2.23 million in losses thanks to several attacks on the platform over the course of several hours. This set of hacks followed a $8.5 million hack in February, and another hack of at least $150,000 in July.
Platypus was quickly able to recover $575,000 from this latest hacker, thanks to a flaw in their attack. Later, they recovered all but $167,400 of the stolen funds after coming to an agreement with the attacker that they would not pursue legal action.
CFTC and FTC sue Voyager CEO Stephen Ehrlich
Simultaneous civil lawsuits from the Commodity Futures Trading Commission (CFTC) and Federal Trade Commission (FTC) against former CEO of the collapsed Voyager crypto lender accuse him of fraud and making deceptive claims to customers.
The FTC lawsuit focuses on Voyager's claims suggesting to customers that accounts with the lender were FDIC insured. That complaint also names Voyager as a defendant. Voyager settled with the FTC, agreeing to pay a $1.65 billion judgment that will be suspended until customers are repaid.
- "CFTC Charges Former Chief Executive Officer of Digital Asset Platform with Fraud in Massive Commodity Pool Scheme", CFTC press release [archive]
- "FTC Reaches Settlement with Crypto Company Voyager Digital; Charges Former Executive with Falsely Claiming Consumers' Deposits Were Insured by FDIC", FTC press release [archive]
- "CFTC and FTC sue former CEO of bankrupt crypto lender Voyager", BlockWorks [archive]
- "Voyager Ex-CEO Charged by U.S. Regulators With Fraud, Making False Claims", CoinDesk [archive]
Black Hole Token exploited for $1.28 million
The Black Hole Token project suffered a $1.28 million apparent exploit, according to security firm PeckShield, though it's hard not to wonder if it might have been a rug pull.
Black Hole Token is a Chinese project built on BNB Chain, which promises an original mechanism that only goes up. "The more you sell, the more the price goes up", promises their website.
Sounds legit.
Fintoch scammers strike again with $1.6 million FinSoul scam
A metaverse gaming project called FinSoul promised users “sandbox worlds, multiplayer sports, leisure experiences, player socializing, MMORPG,” and other features. However, on October 10, the project team made off with $1.6 million, which they then tumbled through Tornado Cash.
The team behind the FinSoul project was reportedly the same as the group who pulled off the much larger $31 million Fintoch exit scam in May. They used similar strategies, including using paid actors to pose as their executive team, to push the FinSoul scam.