An exploiter was able to take advantage of an arbitrary call error that allowed them to steal funds from these various contracts, amounting to around $56,000. Various people associated with Aave emphasized that there was no risk to user funds or flaw in the core Aave protocol, and one described the hack as "raiding the tip jar".
"Peripheral" Aave smart contract hacked for $56,000
The popular defi lending platform, Aave, suffered a smart contract exploit that allowed an attacker to steal around $56,000. A smart contract outside of the core Aave protocol, which is used to allow people to use existing collateral to repay their loans, had gradually accrued a balance of tokens leftover from slippage. These small leftover token amounts are sometimes called "dust". Altogether, these tokens amounted to around $70,000 across several blockchain networks.
OpenSea receives SEC Wells notice
OpenSea has announced that they received a Wells notice from the U.S. Securities and Exchange Commission, warning them of a likely lawsuit from the agency. According to CEO Devin Finzer, "they believe NFTs on our platform are securities". Finzer did not provide any more details about the scope of the SEC's notice.
Finzer promised that the company would vigorously fight any impending lawsuit.
The lawsuit echoes previous enforcement actions by the SEC, such as a September 2023 settlement with the celebrity-backed Stoner Cats project, in which the SEC suggested that it may broadly view NFTs as securities if investors "reasonably expect to profit" from the continued efforts of those who release the NFTs.
Bitcoin mining company Rhodium Enterprises files for bankruptcy
The Texas-based Rhodium Enterprises bitcoin mining company has filed for bankruptcy, disclosing debts between $50 and $100 million and total assets between $100 and $500 million. The company had tried to begin restructuring, but was not able to reach agreement among shareholders, and so decided to enter bankruptcy.
Bitcoin mining has been an extremely challenging business in recent times, partly due to volatile crypto prices over the last few years, and due to diminishing miner rewards following the April halving event.
Rhodium Enterprises had been showing signs of trouble, including failing to make scheduled loan payments earlier this month. In December 2023, a dispute between them and a subsidiary of the Riot Platforms bitcoin mining group culminated in armed security removing Rhodium employees from a bitcoin mining facility in Rockdale, Texas, where Rhodium was leasing bitcoin miners. The case was later sent to arbitration.
Brothers charged by SEC for $60 million "crypto bot" Ponzi scheme
Brothers Jonathan and Tanner Adam were charged with violating the antifraud provisions of the federal securities laws with their GCZ Global and Triten Financial Group entities, which the SEC alleges amounted to a $61.5 million Ponzi scheme that impacted more than 80 victims. The brothers claimed to have a crypto arbitrage bot that would pull from investor funds to perform profitable trades that would earn them 8–13.5% returns. They claimed to investors that, short of a complete meltdown in global financial markets, their funds would be safe.
However, $53.9 million of investor funds were used to pay other investors, in classic Ponzi fashion. The brothers also used investor funds to build houses for themselves and their family, purchase vehicles and designer goods, and make payments on a $30 million condo in Miami for Tanner.
One of the brothers, Jonathan, had in 2004 been convicted on felony securities law violations that resulted in a four-year jail sentence and more than $300,000 in restitution.
- "SEC Charges Brothers Jonathan and Tanner Adam with $60 Million Ponzi Scheme", U.S. Securities and Exchange Commission [archive]
Abra crypto lender charged with securities violations, settles
The SEC charged the Abra cryptocurrency lending platform with failing to register the offers and sales of its retail crypto asset lending product, Abra Earn, and with operating as an unregistered investment company. Abra Earn was available to US customers from July 2020 until June 2023.
Abra settled the charges from the SEC by agreeing to an obey-the-law injunction, and agreeing to pay as-yet-undetermined civil penalties.
In January 2024, Abra settled claims from the Texas State Securities Board by agreeing to refund customers. As a part of the complaint, the TSSB had alleged that Abra was "insolvent or nearly insolvent", and had been making misleading statements. In June 2024, Abra settled with 25 state regulatory agencies, agreeing to refund up to $82.1 million to its US customers. Abra had begun winding down operations in the United States in mid-2023, after facing multiple state regulatory actions.
- "SEC Charges Abra with Unregistered Offers and Sales of Crypto Asset Securities", U.S. Securities and Exchange Commission [archive]
- "Crypto firm Abra reaches settlement with US states for operating without licenses", Reuters
Users suffer losses after Polygon Discord hack
Some fans of the Polygon blockchain, or those looking for help with using it, suffered losses after hackers successfully compromised the project's Discord server. Discord hacks have become a major issue in the cryptocurrency world, and although Polygon is one of the largest projects to suffer a Discord compromise, it's far from the only project to do so.
One member of the Discord described losing more than $140,000 in tokens after clicking a link shared by a person appearing to be a member of the Polygon team, which advertised a token distribution to serve as a "pre-migration celebration".
McDonald's Instagram hacked, hackers claim $700,000 haul
McDonald's Instagram account, as well as the Twitter account of a McDonald's marketing director, began promoting a memecoin called $GRIMACE (named for the restaurant chain's blobby purple mascot). The posts to McDonald's 5.1 million followers caused the token price to spike. Then, the attacker sold off their holdings, profiting around $700,000 and plunging the token price.
They then boasted about their haul on the compromised Instagram account, changing the bio to say: "Sorry mah nigga you have just been rug pulled by India_X_Kr3w thank you for the $700,000 in Solana 🇮🇳".
The token stunt by the massive company was perhaps made more believable by McDonald's previous forays into crypto, including when they launched a McRib-themed NFT project in December 2021. The company had also joked about a "Grimacecoin" back in January 2022, in a reply to a tweet from Elon Musk.
Crypto holder loses over $55 million to apparent phishing attack
Someone holding almost $55.5 million in the DAI stablecoin was apparently phished, signing a transaction to reassign ownership of their DAI stash to a phishing address. The victim appeared to realize their error several hours later, attempting to withdraw the tokens only to have the transaction fail since they were no longer the owner of the assets.
The attacker later moved the stablecoins to a new wallet, and exchanged about half of them for 10,625 ETH.
Former CEO of Heartland Tri-State Bank sentenced to more than 24 years in prison after putting bank funds into crypto scheme
Shan Hanes, the former CEO of the Kansas Heartland Tri-State Bank, was sentenced to 293 months (24 years, 5 months) imprisonment after pleading guilty to embezzlement by a bank officer. Hanes had fallen for a "pig butchering" scam, where he believed he could earn returns by "investing" funds under the bank's control into a cryptocurrency scheme.
Between May and July of 2023, Hanes transferred $47.1 million of the bank's funds to the fraudulent scheme. This ultimately led to the bank collapsing, with equity investors losing $9 million and the FDIC footing the bill. "There were people who lost 70, 80% of their retirement" as a result of their investment losses, stated a community member.
Hanes had also taken money from a local church, an investment club, and his daughter's college savings. These funds were reportedly used to buy cryptocurrency after those running the scheme told him they needed more money to "unlock" the returns on his investments — a common tactic with these scams.
- "Former CEO of failed bank sentenced to prison", U.S. Attorney's Office, District of Kansas [archive]
- "Cryptocurrency 'pig butchering' scam wrecks Kansas bank, sends ex-CEO to prison for 24 years", NBC News [archive]
FutureNet founder arrested for alleged crypto fraud
Roman Ziemian, a co-founder of the alleged crypto pyramid scheme FutureNet, was arrested in Montenegro, where he was living under a false identity. He had previously been arrested in Italy in October 2022, but fled the country after being released to home confinement. Ziemian’s co-founder, Stephan Morgenstern, had also fled authorities after being arrested and released to home confinement in Greece, but was arrested again in Albania in August 2023.
Ziemian was wanted on international warrants from Poland and South Korea. FutureNet, which was established in 2018 and purported to be a crypto trading platform, is alleged to have defrauded numerous people of a combined $21 million. Victims were encouraged to buy "participation packages", and earn rewards for referring others to the scheme. Polish authorities warned that FutureNet might be a pyramid scheme in 2019, and South Korea began an investigation into the company in 2020.
Ziemian faces fraud, money laundering, and theft charges, which could be punished by life imprisonment in South Korea.
- "U Podgorici uhapšeno međunarodno traženo lice koje se sumnjiči za višemilionske prevare", Vlada Crne Gore (in Montenegrin) [archive]
- "Co-founder of crypto fraud scheme FutureNet arrested in Montenegro", ReadWrite [archive]