Stars Arena exploited for $3 million

October 7, 2023

Stars Arena exploited for $3 million

Stars Arena, an Avalanche-based dupe of the popular Friend.Tech project, suffered a serious exploit in which an attacker drained tokens priced at around $3 million.

Avalanche co-founder and CEO Emin Gün Sirer drew widespread mockery when announcing that "the amount lost is only $3m", apparently not perceiving that $3 million is a massive sum to most people. He also didn't mention that it constituted almost the entire total TVL of the Stars Arena project, which was left with less than $1 in tokens following the attack.

Stars Arena was fortunate, in that the hacker ultimately contacted them offering to make a deal. The attacker returned 90% of the funds, keeping $300,000 as a "bounty".

October 6, 2023

THORSwap temporarily shuts down web interface as FTX hacker tries to launder $131 million

(attribution)

The THORSwap decentralized exchange has put its web interface into "maintenance mode" in hopes of thwarting the thief who stole over $400 million from the FTX exchange as it was mid-collapse in November 2022. Those funds have remained largely for almost a year, until the thief began moving funds recently — interestingly, coinciding with the start of Sam Bankman-Fried's criminal trial.

The attacker tried to launder around $131 million of the stolen assets by routing them through services including Railgun and THORSwap. After "consultation with advisors, legal counsel, and law enforcement", THORSwap decided to pause its web interface in hopes of making money laundering more challenging for the attacker — although the thief could still interact with the THORSwap smart contracts directly, if they so chose.

Some criticized THORSwap for apparently caving on its censorship-resistant, decentralized ethos. Others, however, saw the move as understandable given the THORSwap developers reside in the United States, which has recently cracked down on mixing services that facilitate the laundering of illicit funds.

October 6, 2023

Gitcoin loses $500,000 in transfer SNAFU

(attribution)

After agreeing to allocate $500,000 to "MMM" (merchandise, memes, and marketing — no, really), Gitcoin screwed up sending the money so badly that it's gone forever. Whoever was in charge of making the transfer accidentally pasted the Gitcoin contract address into the recipient field, rendering the tokens permanently inaccessible. Such mistakes can be devastating, and yet are very common in the crypto world, where transfers are irreversible.

"Gitcoin DAO gaffe sees $500,000 in GTC tokens lost forever", DL News [archive]

October 6, 2023

Bored Apes' Yuga Labs lays off employees

A sad-looking ape with dark grey fur, wearing a yellow rain cap and a striped shirt

BAYC #5262 (attribution)

Even the best known NFT brand can't escape the effects of a collapsing industry. Yuga Labs, the company behind the blue-chip Bored Apes NFTs and related collections, and the acquirers of collections including CryptoPunks, has announced that it will be joining the many other companies in the crypto world performing layoffs. They did not disclose how many employees would be losing their jobs.

"It's a challenging time, not only for our industry but also for the global economy," wrote Yuga Labs CEO, apparently hoping that people ignorant to the past year of disaster across the NFT industry might be willing to attribute Yuga Labs' struggles to macroeconomic forces and not the implosion of the crypto — and particularly NFT — world.

"Bored Ape Yacht Club NFT Creator Yuga Labs Confirms Layoffs", Decrypt [archive]

October 3, 2023

BigWhale loses $1.5 million in private key leak

(attribution)

The defi staking and lending project BigWhale announced that the private key to one of their crypto wallets had been leaked, and 7,200 BNB (~$1.5 million) had been stolen.

In a long post on Twitter, the project promised "we will refund all investor funds down to the last cent". They also wrote that "Not only are we going to use the fullest extent of the law to go after the person or persons behind this hack / attack, we will also use ALL OTHER MEANS NECESSARY - and we do have such resources at our disposal, to go after the ones who are behind this. (We work with assets within the Russian government directly...)"

In a later post on their website, however, they wrote that they do "not bear legal liability to refund investors for the losses incurred unless the hacked funds are successfully recovered", attributing the incident to force majeure. They repeatedly claimed that they had not been involved in the theft. The project completely took down its website, redirecting it to this post.

October 2, 2023

Crypto.com fined $3.1 million in the Netherlands for operating without registration

(attribution)

Crypto.com spent around two years operating in the Netherlands without bothering to register as required by the Dutch central bank — or pay the supervisory fees they were supposed to be paying. On October 2, 2023, the central bank imposed a €2.85 million (US$3.12 million) fine on the company for the period of unlicensed registration. The company had registered with the regulator in July of that year.

The fine was announced in March 2024, and Crypto.com said it had appealed the penalty.

Crypto.com was hardly the first exchange to fall afoul of the regulator: Binance was fined $3.35 million in July 2022 for the same, and Coinbase was hit with a $3.6 million for the same in January 2023. Binance later shut down their Dutch operations after failing to obtain a license.

"Fine for Foris DAX MT Limited (Crypto.com) for having provided crypto services without the required registration until 2 August 2023", De Nederlandsche Bank [archive]

September 29, 2023

Former FTX auditor Prager Metis sued by SEC for hundreds of alleged violations

Prager Metis' headquarters in Decentraland (attribution)

The U.S. Securities and Exchange Commission filed a lawsuit against auditor Prager Metis, who they allege violated auditor independence rules and aided and abetted their clients' violations of federal securities laws. According to the SEC, Prager Metis included indemnification provisions in more than 200 audits, reviews, and exams, which renders the firm no longer independent in its investigations of those clients.

Prager Metis is among the auditors who audited FTX, and was noted by FTX's CEO-in-bankruptcy John J. Ray III for advertising itself as "the first CPA firm to officially open its headquarters inside the metaverse".

None of the clients involved with the faulty audits were disclosed in the lawsuit, and the SEC has not issued any statements connecting the charges to the FTX collapse.

September 29, 2023

Three Arrows Capital co-founder Su Zhu jailed for four months

Su Zhu (attribution)

Co-founder of the collapsed Three Arrows Capital hedge fund, Su Zhu, was arrested in Singapore while allegedly trying to leave the country. He and his cofounder Kyle Davies have been uncooperative with investigations into the June 2022 implosion of the fund, and were both sentenced to four months imprisonment as a result. Davies has not been arrested because his whereabouts are currently unknown.

Three Arrows Capital fell apart in June 2022, and was among one of the first major collapses that set off a domino effect of crypto company failures throughout that summer and the rest of the year.

"Three Arrows Co-Founder Zhu Apprehended, Liquidator Says", Bloomberg [archive]

September 26, 2023

Chase UK to block payments for crypto

(attribution)

Chase Bank’s UK branch has decided it will completely block debit card purchases and bank transfers that it identifies as being "related to crypto assets", a move they say is motivated by an increase in crypto scams targeting UK customers. Chase customers who want to buy crypto will have to use some other bank, Chase has said.

The change is scheduled to go into effect on October 16.

"Chase U.K. to Block Crypto Payments Citing Fraud, Scams", CoinDesk [archive]

September 25, 2023

JPEX appears to be a $191 million fraud

(attribution)

After the Hong Kong-based JPEX exchange limited withdrawals amidst what appeared to be an impending collapse of the platform, things are now looking a lot more like fraud.

Police have received more than 2,200 complaints pertaining to the exchange, involving $191 million (and counting) in possible losses. Eleven people, including various crypto influencers who had promoted the exchange, were taken in for questioning. However, police have said those eleven people were not likely central to the fraud, and that the leaders of the JPEX project are on the run.

According to the South China Morning Post, "The alleged case of financial fraud involving HK$1.37 billion is the largest of its kind in Hong Kong's history."

"Hong Kong JPEX scandal: who are the suspects arrested so far and how are they tied to cryptocurrency platform?", South China Morning Post [archive]

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.