Flash loan attack nets attacker $370,000 from several sources
An attacker using the Avalanche blockchain successfully executed a flash loan attack impacting one contract and several other liquidity providers. The attacker made around $370,000 in USDC from the attack.
Binance plans to convert USDC and other stablecoins into their own BUSD stablecoin
Binance users who hold USDC (USD Coin), USDP (Pax Dollar), or TUSD (True USD) will find their holdings "converted" into Binance's stablecoin, BUSD, on September 29. The three stablecoins that Binance plans to convert are the second, fifth, and sixth largest stablecoins on the market as of September 5.
Binance claims the move is to "enhance liquidity and capital-efficiency for users", but the conversion and Binance's related decision to stop trading on spot pairs involving those same stablecoins seems like an attempt to increase the status of its own stablecoin against that of rivals.
Poolin suspends withdrawals from their wallet service
PoolinWallet is a crypto wallet service provided by Poolin, which runs the fourth-largest Bitcoin mining pool and third-largest Ethereum mining pool in the world. In the announcement they wrote that "Poolin Wallet is currently facing some liquidity problems due to recent increasing demands on withdrawals. But please be assured, all user assets are safe and the company's net worth is positive." The firm also urged users to ignore rumors of a rug pull.
Poolin users had been complaining about issues withdrawing from their Poolin wallets since at least August, which had sparked rumors of liquidity problems prior to the announcement. Poolin said in their announcement that they would announce their plans to resume withdrawals within two weeks. However, a week later, they instead told customers they would be receiving "IOU" tokens.
Bitcoiner gets 6–15 months in prison, warns others about making peer-to-peer Bitcoin trades
Mark Hopkins, also known as "Doctor Bitcoin" or "Rizzn", announced on social media that he would be spending between 6 and 15 months in federal prison "for the crime of selling Bitcoin a few years ago". His charge carried a maximum sentence of five years imprisonment.
In 2019, his home was raided in connection to a Nigerian lottery scam, for which he converted between half a million and $1.5 million to cryptocurrency over the span of half a year. He was ultimately charged with "illegally operating a cash-to-cryptocurrency conversion business", to which he pleaded guilty (by his telling, in an attempt to get charges against his family members dropped).
Hopkins claims that "any time anyone with a crypto trades p2p (i.e., not with an exchange), they're legally liable under this statute as it's currently interpreted", though authorities have claimed that Hopkins knowingly aided the lottery scammer by telling them "I'm set up as a marketing company, so tell them you're paying for a marketing campaign".
- 'Doctor Bitcoin' Pleads Guilty to Illegal Cash-to-Crypto Scheme, U.S. Attorney’s Office of the Northern District of Texas
- "Bitcoiner sentenced to federal prison warns users involved in OTC trading", CoinTelegraph
Islamic State tests out NFTs
In the apparent "first known nonfungible token created and disseminated by a terrorist sympathizer", a supporter of the Islamic State has minted an NFT with a message praising an attack on a mosque in Kabul, Afghanistan. According to former U.S. intelligence officials cited by The Wall Street Journal the NFT is likely an experiment with new funding and channels for propaganda.
The token was briefly listed on OpenSea, Rarible, and various other marketplaces before those marketplaces took it down. However, because it was minted on the blockchain, the token itself cannot be removed. "It's very much an experiment...to find ways to make content indestructible," said Raphael Gluck, a co-founder of a jihadist research group.
- "Islamic State Turns to NFTs to Spread Terror Message", The Wall Street Journal
Crypto scam watchdog group launches NFT project, which is then exploited
The group Rug Pull Finder aims to combat fraud, scams, and hacks in the NFT space, often investigating crypto rug pulls and offering audits for projects and smart contracts. They decided to launch their own NFT project, "Bad Guys", which is themed around a group of baddies who steal NFTs.
Ironically, a flaw in the project's smart contract allowed individual wallets to mint many NFTs at once, rather than one per wallet, allowing two people to game the system and snap up more than 450 NFTs rather than the one they were allowed. Rug Pull Finder wrote that "An exploit was shared with us 30 minutes before mint went live. After reviewing it with 3 different dev teams, we did not believe the credibility of the information sent to us... We were clearly wrong, and we are truly truly sorry".
Rug Pull Finder announced that they had reached an agreement with the people who gamed the mint, and would buy back the 366 NFTs the duo still held for 2.5 ETH (~$4,000).
Crypto security researcher OKHotshot wrote, "I think its concerning when security minded projects like RugPullFinder get their discord breached and their code exploited yet they're offering those exact services to customers."
Georgian Coinbase customers take advantage of 100x price bug
Some Coinbase customers in Georgia (the country, not the state) took advantage of an hours-long price bug where a misplaced decimal point altered the exchange rate of the Georgian Lari (GEL) to 100x its actual value. Users were able to sell their cryptocurrencies for GEL to receive, in some cases, thousands of dollars more than the trades were worth. According to Blockworks, some users exchanged $150 worth of crypto for $15,000, more than three times the national average salary in the country.
Some users who took advantage of the bug and withdrew funds to their bank accounts found their accounts frozen shortly after, when Coinbase noticed the error and began working to claw back the funds. According to Coinbase, about 1,000 users took advantage of the error.
Attacker exploits bug in ShadowFi to empty $300,000 liquidity pool
An attacker discovered that anyone could call the burn function on the liquidity pool contract for the ShadowFi project. They were able to exploit this vulnerability by calling the burn function and then taking advantage of the price difference (based on the new circulating supply) to remove all 1078 BNB (~$298,000) in the project's liquidity pool.
The project had only just launched that same day, after running a presale of their SDF tokens. The project promised to allow people to "Take your spending away from the floodlights of surveillance capitalism" and apparently involves sending people prepaid Visa cards to help them cash out their cryptocurrency without connecting a bank account or providing KYC information.
Holding company for Mercado cuts 15% of employees
2TM, the holding company for the Brazilian crypto exchange Mercado, announced they would be laying off 15% of their workforce — about 100 people. The company had previously laid off more than 80 employees in June. Mercado raised a $200 million Series B funding round in July 2021, which valued the company at $2.1 billion — the highest-valued crypto exchange in Brazil.
Describing the layoffs, a spokesperson for 2TM said that Mercado was suffering for playing by the rules. "The competitive environment remains deteriorated and unfair, lacking the approval of the legal framework for crypto-activities, as players following the law are penalized by companies that ignore local rules."
dYdX infuriates users by requesting "liveness checks" via webcam, cancels campaign due to "overwhelming demand"
The decentralized crypto exchange dYdX announced on August 31 that they would give users $25 if they completed a "liveness check", which is accomplished by taking webcam facial scans that can then be compared with scans from other accounts on the exchange in an attempt to combat Sybil attacks.
This infuriated many crypto users, who were horrified that dYdX would try to collect this kind of biometric data. "DYDX just nuked itself. I would never use this platform," wrote a prominent trader.
On September 1, dYdX tweeted that "Due to extremely overwhelming demand of the $25 deposit bonus promotion, we are ending the campaign, effective immediately. Thank you to the many thousands of new users that onboarded to dYdX today. We truly underestimated the amount of interest the campaign garnered." They made no mention of the backlash against the liveness checks, but quietly removed the mentions of the system from their website.