Four pricey NFTs stolen from actor Seth Green, complicating his plans for an animated series

May 17, 2022

Four pricey NFTs stolen from actor Seth Green, complicating his plans for an animated series

Portrait of Seth Green speaking into a microphone

Actor Seth Green tweeted that he had been targeted with a phishing attack that resulted in the theft of four pricey NFTs: a Bored Ape, two Mutant Apes, and a Doodle. The thief quickly flipped three of the four NFTs for sale, netting 145.5 ETH (about $300,000).

The theft occurred on May 8, though Green only seemed to notice on May 17 when he tweeted, "Well frens it happened to me. Got phished and had 4NFT stolen."

The loss of the Bored Ape was later revealed to have put Green in a bit of a pickle, when he released the trailer for a new animated series he was developing that starred his pilfered primate. Given that BAYC ownership grants commercial usage rights (which are presumably transferred to the new owners when the NFT changes hands), the person who bought the NFT flipped by the phisher could have possibly brought a lawsuit against Green if he moved forward with the series.

Green ultimately spent about $300,000 to buy his ape back from the hacker.

Tweet by Seth Green
"Someone Stole Seth Green's Bored Ape, Which Was Supposed To Star In His New Show", BuzzFeed News

May 16, 2022

American running "untraceable" service "designed to evade US sanctions" is charged after being traced

An unidentified US citizen transferred more than $10 million in Bitcoin to a cryptocurrency exchange in a "comprehensively sanctioned" country where they were running a payments platform. They advertised that transactions through the platform were untraceable, and described the platform as designed to evade U.S. sanctions. Despite this, law enforcement was able to obtain information from U.S. and foreign cryptocurrency exchanges — including KYC information provided by the individual — to help identify and trace the individual behind it.

Though the country is as yet unnamed, the limited number of countries sanctioned in the way described in the decision allow us to deduce that it was either Cuba, Iran, North Korea, Syria, or Russia. This case marked the D.O.J.'s first criminal prosecution involving alleged use of crypto to evade sanctions.

U.S. Magistrate Judge Zia M. Faruqui wrote in the opinion: "Virtual currency is traceable. Yet like Jason Voorhees the myth of virtual currency's anonymity refuses to die. See Friday the 13th (Paramount Pictures 1980)."

"US brings first-of-its-kind criminal charges of Bitcoin-based sanctions-busting", The Register
"U.S. issues charges in first criminal cryptocurrency sanctions case", The Washington Post
Memorandum Opinion

May 16, 2022

Scream lending protocol racks up $35 million in bad debt after hardcoding not-so-stablecoin prices to $1

(attribution)

The defi lending protocol Scream may have taken the "stable" in "stablecoin" a bit too literally when they hardcoded the prices of the Fantom USD (fUSD) and DEI stablecoins. In the past few weeks we've seen many stablecoins wobble, and when fUSD and DEI followed suit, Scream ended up in trouble. Users were able to take advantage of the inaccurately high price to borrow other stablecoins on the cheap, leaving Scream with $35 million in bad debt. The platform's reserves of other stablecoins were completely drained; meanwhile, Scream users holding fUSD or DEI can't withdraw.

"DeFi lender left with $35 million bad debt after quoting depegged stablecoins at $1", The Block

May 16, 2022

CZ admits Binance held Luna and UST in bizarre tweet threads

(attribution)

On May 15, Binance CEO Changpeng Zhao (widely known as CZ) created a tweet thread in which he attempted to speak nonchalantly about questions that had "just occurred to [him]" about whether Binance held any UST. In the thread he attempted to distance himself from decisions or knowledge around such holdings, speaking cavalierly about how "we probably do have some". Former FBI agent James Harris wrote an interesting analysis of the thread, concluding, "If people weren't worried before, they will be now. If investigators weren't suspicious before, they should be now."

The following day, CZ tweeted, "Binance received 15,000,000 LUNA (at peak worth $1.6 billion USD, now not much) as part of the original ($3m) invest. 560x return at peak." In this tweet, "not much" glossed over the fact that these LUNA, obtained in return for a $3 million investment and at one point nominally worth $1.6 billion, are now worth $2,900.

He also wrote that Binance had 12,000,000 UST — worth $12 million when UST was properly pegged, and now worth $1.16 million (assuming liquidity exists to sell it at all).

May 16, 2022

Luna Foundation Guard reports what it did with its Bitcoin reserves, raising more questions

(attribution)

Many were eagerly awaiting a report from Luna Foundation Guard (LFG) on what happened to the several billion dollars' worth of Bitcoin reserves they once held, which they transferred during the UST collapse. The organization tweeted an explanation of the actions they took with those funds on May 16, describing how they began to convert Bitcoin to UST. They referred to transferring BTC and other reserves to "a counterparty", who traded them UST in exchange. They didn't name who these counterparties were.

More than a few people were unsatisfied with this reporting, asking more transparency around who these "counterparties" were. Ultimately, this action benefited the "counterparties", providing liquidity to these whales who were able to exit their now risky UST positions for a good price, and did not help most of the individuals holding UST.

Tweet thread by Luna Foundation Guard

May 15, 2022

"Stable"coin DEI loses peg

(attribution)

Another stablecoin lost its peg as dominoes continued to fall in the declining crypto market. DEI, an algorithmic stablecoin created by Deus Finance on the Fantom network, de-pegged on May 15. Intended to be pegged to the US dollar, the token dipped to a low of around $0.50, and continued to hover well below its intended price through the next day. DEI had a nominal market cap of more than $88 million before losing its peg.

This is another bump in the road for Deus Finance, which lost a total of $16.4 million in two separate flash loan attacks in March and April 2022.

"Fantom Stablecoin DEI Becomes Latest to Lose Dollar Peg", CoinDesk

May 15, 2022

Flash loan attacks on "Feed Every Gorilla" token take $1.9 million

(attribution)

A flash loan attack on the "Feed Every Gorilla" (FEG) token swap contracts pulled $1.3 million from the project, also tanking the token price by 80%. The project operates on both the Ethereum and BSC chains, and the attacker was able to use the exploit against the contracts on both networks. Shortly after the first attack, FEG was hit with a second flash loan attack that drained another $590,000 from the project.

Prior to these attacks, FEG had earned some notoriety from a May 2021 Vanity Fair article outlining an alleged pump-and-dump scheme, titled "Inside the Rise and Fall (and Rise and Fall) of Shit Coins". Despite the bad press, much of the FEG community maintained that the article was a smear and nothing more than an attempt by the author to create FUD. "You could literally take every token and this would apply to everyone..." wrote a moderator of the official FEG subreddit.

May 15, 2022

People continue to wait for a public accounting of what happened to Terra's $3.5 billion in Bitcoin reserves

(attribution)

Now that the dust is settling somewhat from the dramatic collapse of Terra, people are beginning to wonder when they'll hear more about what exactly happened to the 80,394 Bitcoin (priced at $3.5 billion at time of purchase; priced closer to $2.5 billion at the time of writing this entry) that previously belonged to Luna Foundation Guard (LFG). The project had previously purchased the assets to hold as reserves, and as UST began to lose its peg, LFG announced they would use those reserves to buy UST to help maintain the peg. Over the next few days, the reserves were emptied, but after they were moved to the Gemini exchange they became impossible to trace further. Although transactions are usually quite traceable on the blockchain, when funds are moved to services like the Gemini exchange, they become impossible to trace using public data because of how exchanges pool funds and transactions internally.

Terraform Labs CEO Do Kwon tweeted on May 13 that "We are currently working on documenting the use of the LFG BTC reserves during the depegging event. Please be patient with us as our teams are juggling multiple tasks at the same time." It's not clear when this documentation will be released. Binance CEO Changpeng Zhao joined the group of people asking about the BTC reserves, tweeting, "I would like to see more transparency from them. Much more! Including specific on-chain transactions (txids) of all the funds. Relying on 3rd party analysis is not sufficient or accurate."

May 13, 2022

Blockchain insurance company InsurAce shortens their claims window for Terra holders to just a week

(attribution)

InsurAce is a defi insurance provider (oh yes, they exist) that allows people to buy insurance against events including smart contract vulnerabilities and stablecoin depegs. Following the Terra collapse, InsurAce suddenly announced that its customers who held Terra had only a week to file claims, and that "Late submission [sic] will be rejected without further appeal".

Altogether, InsurAce says they paid out about $11 million to around 173 claimants as a result of the depeg. Evidently there were 61 others who did not submit their claims within the deadline.

"InsurAce says it will pay millions to claimants after Terra’s collapse", CoinTelegraph

May 13, 2022

SpiritSwap is the latest victim of a domain hijacking attack

(attribution)

In what is beginning to become a pattern, SpiritSwap was the latest project where attackers gained control of their domain and were able to modify the frontend to divert funds to a wallet under their own control. SpiritSwap tweeted that the "the hacker has managed to exploit Godaddy" (unlikely — it was more likely a case of stolen credentials) and swap out the recipient address.

The hacker only managed to exfiltrate around $18,000 before being discovered, and SpiritSwap shut down their swapping through their router to prevent the attack from continuing.

MM.Finance suffered a similar attack earlier in the month, losing $2 million after an attacker gained control of the domain and swapped in their own address to siphon funds.

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.