PlayDapp crypto gaming platform exploited, spurring misleading headlines

February 9, 2024

PlayDapp crypto gaming platform exploited, spurring misleading headlines

The South Korean blockchain gaming platform PlayDapp was hacked on February 9, and an attacker minted 200 million $PLA tokens. These were notionally priced at around $36.5 million, although because only 577 million $PLA were in circulation before the unauthorized mint, there would not have been sufficient liquidity for the attacker to sell them at around that price.

Days after the initial attack, on February 12, the attacker minted another 1.59 billion $PLA. This has led to news reports that the platform was exploited for "$290 million". However, this value is being naively calculated based on the token price without taking into account the massive supply inflation, and ignoring that that dollar figure is more than 2.5x the total claimed market cap of the token. Even reputable outlets like Bleeping Computer have printed the figure in their headline (though Bleeping Computer later changed the headline to a more accurate one).

PlayDapp sent on-chain messages to the attacker, offering a bounty, but the offer was ignored.

"PlayDapp exploit continues into 4th day, with losses reaching $290M", Cointelegraph [archive]
"Hackers steal $290 million in crypto from PlayDapp gaming platform", Bleeping Computer [archive]

February 6, 2024

Solana goes down for five hours

(attribution)

They were doing so well! After suffering a slew of outages during 2022, Solana had seemed to get their act together in 2023 with only one major outage. Now, however, Solana has gone offline again for five hours.

With blockchains promising to become "world computers" upon which anyone can create projects ranging from mere toys to critical infrastructure, uptime is crucial, and a five-hour-long outage is devastating.

"Solana Blockchain Suffers 5-Hour Outage", CoinDesk [archive]

February 1, 2024

SIM swappers charged over hacks, reportedly including FTX

Three people running a SIM swapping operation have been charged with fraud and identity theft. By gaining access to the personal information of their victims and then convincing cell phone providers to "swap" victims' phone numbers to phones they controlled, they were then able to gain access to various accounts controlled by their victims.

Although the indictment does not name FTX, Bloomberg has reported that "victim company-1" named in the court filings was FTX, which was hacked for around $400 million amid the chaos as the company was collapsing.

"FTX’s Missing $400 Million Were Stolen in SIM-Swapping Hack, DOJ Says", Bloomberg [archive]

February 1, 2024

Crypto exchange created by Three Arrows Capital founders to shut down

(attribution)

Who can believe this. OPNX, the crypto derivatives exchange created by the people who ran and then blew up the Three Arrows Capital hedge fund, will be shutting down. The exchange was originally announced in January 2023, with a tentative name of "GTX" — "because G comes after F", they said. It was created as an evolution of the CoinFLEX exchange, which had become insolvent and halted withdrawals in June 2022. Much of the exchange's focus was on allowing creditors of bankrupt cryptocurrency projects to trade their claims — including claims on Three Arrows Capital.

Now, as Su Zhu emerges from several months in jail, he, Kyle Davies, and the other executives of OPNX are shutting down the project. Traders have a week to settle their positions, and another week before the platform closes entirely.

Both Zhu and Davies are, of course, trying to promote a new crypto derivatives trading project.

"Crypto derivatives exchange OPNX to shut down in February", The Block [archive]

January 31, 2024

More than $58 million stolen in Twitter phishing schemes in January

Scam Sniffer's January 2024 report describes more than 40,000 victims who collectively lost more than $58 million thanks to various phishing schemes on the Twitter platform.

The top seven victims collectively lost $17 million, with the top victim alone losing $4.7 million.

"Scam Sniffer Report: $55 Million Stolen Due To Phishing In January", Scam Sniffer [archive]

January 31, 2024

$112.5 million in XRP stolen from Ripple CEO Chris Larsen

Chris Larsen (attribution)

Blockchain sleuth zachxbt noticed the strange movement of around 213 million XRP, the native token for the Ripple project. These tokens were priced at around $112.5 million at the time of the theft. He originally identified the source of funds as Ripple itself, though Ripple CEO Chris Larsen later went on Twitter to claim that the funds that were stolen had come from his personal wallets and not from wallets belonging to the Ripple project.

Larsen attempted to downplay the massive theft, claiming repeatedly that the theft did not represent a threat to Ripple itself, and trying to reassure people that Ripple wallets are still safe. However, fears over a threat to Ripple itself and the true separation between Larsen's wallets and those belonging to the Ripple project continued, and XRP dipped around 5% on the news.

January 30, 2024

Abracadabra exploited for almost $6.5 million, Magic Internet Money stablecoin depegs

(attribution)

Well that sure is a headline I just had to write.

The Magic Internet Money ($MIM) stablecoin has lost its dollar peg again, dipping all the way below $0.77 in a flash crash before returning to around $0.95.

The depeg appears to be related to an exploit of the Abracadabra lending protocol, which allows people to borrow $MIM. An attacker exploited an apparent flaw in the platform's smart contracts to drain around $6.5 million.

This is the second time the token has depegged, after a June 2022 incident shortly after the Terra collapse.

"Abracadabra's $6.49M loss leads to MIM stablecoin destabilization", Cointelegraph [archive]

January 29, 2024

HyperVerse founder Sam Lee charged

Sam Lee (attribution)

US Attorneys in Maryland and the US Securities and Exchange Commission filed criminal and civil lawsuits, respectively, against Sam Lee, the co-founder of the HyperVerse cryptocurrency investment scheme, which has defrauded victims of between $1.3 billion and $1.9 billion depending on whose estimate you use. The US Attorneys have accused Lee of securities fraud and wire fraud. The SEC has accused Lee and a major HyperVerse promoter, Brenda Indah Chunga (aka "Bitcoin Beautee"), of securities fraud and offering unregistered securities.

This is the second HyperVerse related criminal charge in recent days, following the arrest of promoter "Bitcoin Rodney".

January 28, 2024

Goledo Finance hacked for $1.7 million

(attribution)

Goledo Finance, an Aave-based lending protocol, was exploited through a flash loan attack. The attacker stole assets estimated by CertiK at around $1.7 million.

Goledo Finance contacted the attacker to offer a 10% "bounty" for the return of the remaining assets. In a message on January 29, the attacker wrote: "I hacked Goledo and want to negotiate".

Tweet by CertiK [archive]
On-chain message from the attacker [archive]

January 27, 2024

Korean crypto karaoke platform Somesing hacked

(attribution)

Have you ever gone out to karaoke and thought "man, the only thing missing from this perfect night is a blockchain"? No? Weird.

Anyway, the South Korean Somesing platform — which is really more of a TikTok-but-just-for-song-covers clone than anything to do with karaoke — suffered a breach in which 730 million SSX tokens were stolen. These tokens are nominally priced at around $11.5 million, but around 2/3 of the stolen tokens were as yet undistributed and not a part of the circulating supply.

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.