The group announced that they were working with "the FBI, the Department of Homeland Security, our regulators and Chainalysis" to investigate the attack. The group had previously earned SOC 2 certification for its cybersecurity controls.
FPG halts withdrawals after $15–20 million hack
The institutional cryptocurrency broker Floating Point Group (FPG) announced to customers on June 14 that they would be suspending all activity on their platform following a "cyber security incident" that had occurred on June 11. "While the loss at this point is still being investigated and analyzed, the number as we understand it today is between $15M-$20M in cryptocurrencies lost," they wrote on Twitter.
Texas securities regulator alleges in cease-and-desist that Abra crypto lender has been insolvent for months
In an emergency cease-and-desist issued on June 15, the Texas State Securities Board alleged that the Abra crypto lending firm was "insolvent or nearly insolvent" as of interviews conducted on March 31. The filing alleged that Abra and its founder William Barhydt had made investment offerings that were materially misleading, accusing them of securities fraud. Despite not contesting securities regulators' conclusion that Abra was insolvent, Abra repeatedly posted statements on social media such as the one on June 11, where they wrote "Abra is not bankrupt".
According to the complaint, although Abra claimed it stored customer funds with the Fireblocks crypto custodian, they had actually been "secretly transferring assets" to Binance.
The regulator also alleged that Abra had around $30 million in assets with Babel Finance, $30 million with Genesis, and $10 million with Three Arrows Capital — three companies in various stages of liquidation or bankruptcy. They also have $8.8 million with Auros, a firm that was in liquidation but has since exited the process.
Delio crypto lender suspends withdrawals
South Korean cryptocurrency lending platform Delio announced to its customers on June 14 that they would be suspending withdrawals. In a letter to customers, they wrote that the decision was taken in response to the withdrawal suspension by Korean yield platform Haru Invest the previous day, which they said had led to a "sharp increase in market volatility and increased confusion among investors". Haru's suspension had caused a "sudden surge of withdrawals on our end", said Delio CEO James Jung.
Delio, like Haru, advertised yields of more than 10%.
- "출금 중지 조치 안내", Delio (in Korean)
- "Two Crypto Platforms Halt Withdrawals in an Echo of the Sector’s 2022 Woes", Bloomberg
Banq goes banqrupt
Banq, a subsidiary of the Prime Trust crypto custodian, has filed for bankruptcy. Banq is a "crypto-friendly" payment processor based in Nevada, though according to the bankruptcy documents, former CEO Scott Purcell decided to try to pivot the company away from payments and into NFTs without approval from the board of directors. Banq's parent company, Prime Trust, has also been the subject of insolvency rumors recently.
In the bankruptcy filings, Banq alleges that $17.5 million in assets were stolen by former officers, described in the listing as "computers, trade secrets, proprietary information and technology, business records, etc." The transfer allegedly was made to Fortress NFT Group, a rival company founded by the former CEO, CTO, and CPO. A lawsuit from Banq filed against Fortress and the executives in May 2022 alleges that the executives "stole not only Banq's technology, but also significant other value of Banq's, and used the purloined property to launch Defendants Fortress NFT and Planet NFT using Banq's assets, employees, trade secrets and proprietary technology, claiming all of it to be their own." They also claim that the defendants deleted files and engaged in other fraudulent activity to try to cover up the theft.
Haru Invest suspends withdrawals
The South Korean yield platform Haru Invest abruptly suspended withdrawals and deposits on June 13. They wrote in a blog post that they were experiencing "a certain issue" with an unnamed partner, later announcing that "we have discovered through our internal inspection process that certain information provided by a consignment operator was suspected to be false."
The following day, the company named the partner as B&S Holdings (formerly Aventus), and announced that they were taking legal action against the company for filing falsified management reports.
Haru Invest advertised APR in the double digits.
On June 22, Haru laid off 100 employees. Haru explained in a blog post: "after much consideration, it comes with a heavy heart to inform you that we will be minimizing the operations of Haru Invest and its affiliated companies to prevent further damages that are likely to be incurred". Haru's CEO told local media that Haru's offices were empty because employees were working from home for their own safety. After Haru halted withdrawals, they closed their office, and CoinDesk reported that "all company officials disappeared".
BNB Chain team prepares to step in to prevent massive Venus Protocol liquidation
After the massive BNB Chain bridge hack in October 2022, the hacker was able to take out a massive position with the Venus Protocol defi lending project. They borrowed $150 million in stablecoins by putting up 900,000 BNB (~$244 million at the time).
The recent SEC lawsuit against Binance has caused the BNB token to plummet almost 25%, from $305 to ~$230. This puts the hacker's position dangerously close to the liquidation threshold of $220, which could cause substantial impact on the market via cascading liquidations.
In November, BNB Chain passed a governance proposal giving the BNB Chain core team the ability to liquidate the position if it approached the liquidation threshold, meaning they could repay the debt in a more controlled manner that wouldn't dump hundreds of thousands of BNB onto the market all at once.
On June 12 the Venus team tweeted a reminder: "BNBChain core team is ready to take over the $BNB position on Venus as planned if the BNB price hits the liquidation threshold. The liquidator address has prepared $30M already to refund the account loans with more to come if needed. No BNB will be dumped into the market and no shortfall is expected on Venus."
This is not the only bad debt on the Venus platform, which has been described as "opaque" by Protos and has been accused of trying to hide some of its liabilities.
Abandoned Atlantis Loans project exploited for $1.1 million
Although developers abandoned the Atlantis Loans defi lending project in early April due to "financial difficulties", as a self-executing defi protocol it has continued to chug along rather like a zombie. As the developers wrote when they abandoned the project, "Atlantis Loans as a protocol is fully decentralized and the only way to make changes or turn things off will have to be done through the governance."
Evidently, few people continued to pay much attention to the project, because an exploiter was able to come along and perform a governance attack targeting the users who still had active smart contract approvals with the defunct project. They published and voted on a proposal to allow them to upgrade the smart contract in such a way that they could then take advantage of the approvals to transfer the tokens to their own wallet address. Ultimately they made off with around assets notionally worth around $1.1 million.
Sturdy Finance exploited for $775,000
The Sturdy Finance defi lending protocol was exploited, with hackers taking advantage of an oracle manipulation vulnerability to make off with 442 ETH (~$775,000). They subsequently transferred the funds into Tornado Cash. The total loss to the project was somewhat higher: 504 ETH (~$884,000).
Roughly an hour after the attack, the project tweeted that they were aware of the attack, and had paused all markets. On June 19 the project sent a message to the attacker, pleading with them to return the funds and threatening: "There are criminal organizations following the same evidence trails we are. This isn't going away until you return funds. We are your best option out of this."
Minting of TrueUSD stablecoin through Prime Trust halted; TUSD deviates from peg
On June 10, TrueUSD announced on Twitter: "TUSD mints via Prime Trust are paused for further notification." They offered no further explanation. TUSD is the fifth largest stablecoin by market capitalization.
The decision may have been related to insolvency rumors surrounding Prime Trust, a US-based fintech company. On June 8, BitGo announced a non-binding letter of intent to acquire Prime Trust.
After the announcement, the TUSD stablecoin dipped as low as $0.9951. This is a seemingly small deviation from the $1 peg, but in the stablecoin world, such small variances can be serious.
- "TrueUSD stops minting via Prime Trust, loses dollar peg", CoinTelegraph
Crypto.com to shut down institutional trading in the US
Singapore's Crypto.com has announced it will be imminently shutting down its institutional exchange service in the US, citing "limited demand from institutions in the U.S. in the current market landscape". The firm will continue to serve retail customers in the country, however.