The posts were deleted and accounts were locked down very quickly by Twitter, but not before approximately 2,000 people bought around $1.8 million of the fake token.
Trump family Twitter accounts compromised ahead of World Liberty Financial launch
The Twitter accounts belonging to Lara and Tiffany Trump were compromised and used to announce a fake launch of the (unfortunately real) World Liberty Financial project that their family has been promoting. Donald Trump's son Eric tried to warn people of the scam, but in doing so retweeted the scam tweet containing the malicious token address.
Penpie hacked for $27.3 million
The defi protocol Penpie was exploited for 11,113.6 ETH (~$27.3 million) by an attacker who exploited a flaw allowing them to withdraw unearned "rewards". Although the protocol claimed to have been audited by two blockchain security firms, they later disclosed that the smart contracts containing the bugs had not been fully audited.
The team behind Pendle (the platform on which Pendie is built) detected the attack and paused Pendle an hour after the attack began, which they claim prevented another $105 million from being stolen.
Members of the Penpie team filed complaints with Singaporean police and the US FBI. They also attempted to negotiate a "bug bounty" via on-chain and social media messages to the attacker, but the hacker seems uninterested and has continued to transfer funds between various crypto wallets and launder funds through Tornado Cash.
SEC charges Galois Capital, Galois settles
Eighteen months after the crypto-focused algorithmic trading fund Galois Capital shut down, explaining that they had lost around $40 million in the FTX collapse, the SEC has filed a lawsuit against the firm for failing to properly custody their clients' funds. According to the SEC, instead of complying with SEC requirements that investment advisers hold assets with qualified custodians like banks, Galois was keeping assets on crypto exchanges including FTX.
The SEC also charged that Galois Capital had misled some investors into believing they needed five business days of notice to redeem assets, while other investors were allowed to redeem assets more quickly.
Galois agreed to a settlement with the SEC in which they will pay a $225,000 penalty, which will go to investors who lost money.
- "SEC Charges Crypto-Focused Advisory Firm Galois Capital for Custody Failures", U.S. Securities and Exchange Commission
"Peripheral" Aave smart contract hacked for $56,000
The popular defi lending platform, Aave, suffered a smart contract exploit that allowed an attacker to steal around $56,000. A smart contract outside of the core Aave protocol, which is used to allow people to use existing collateral to repay their loans, had gradually accrued a balance of tokens leftover from slippage. These small leftover token amounts are sometimes called "dust". Altogether, these tokens amounted to around $70,000 across several blockchain networks.
An exploiter was able to take advantage of an arbitrary call error that allowed them to steal funds from these various contracts, amounting to around $56,000. Various people associated with Aave emphasized that there was no risk to user funds or flaw in the core Aave protocol, and one described the hack as "raiding the tip jar".
OpenSea receives SEC Wells notice
OpenSea has announced that they received a Wells notice from the U.S. Securities and Exchange Commission, warning them of a likely lawsuit from the agency. According to CEO Devin Finzer, "they believe NFTs on our platform are securities". Finzer did not provide any more details about the scope of the SEC's notice.
Finzer promised that the company would vigorously fight any impending lawsuit.
The lawsuit echoes previous enforcement actions by the SEC, such as a September 2023 settlement with the celebrity-backed Stoner Cats project, in which the SEC suggested that it may broadly view NFTs as securities if investors "reasonably expect to profit" from the continued efforts of those who release the NFTs.
Bitcoin mining company Rhodium Enterprises files for bankruptcy
The Texas-based Rhodium Enterprises bitcoin mining company has filed for bankruptcy, disclosing debts between $50 and $100 million and total assets between $100 and $500 million. The company had tried to begin restructuring, but was not able to reach agreement among shareholders, and so decided to enter bankruptcy.
Bitcoin mining has been an extremely challenging business in recent times, partly due to volatile crypto prices over the last few years, and due to diminishing miner rewards following the April halving event.
Rhodium Enterprises had been showing signs of trouble, including failing to make scheduled loan payments earlier this month. In December 2023, a dispute between them and a subsidiary of the Riot Platforms bitcoin mining group culminated in armed security removing Rhodium employees from a bitcoin mining facility in Rockdale, Texas, where Rhodium was leasing bitcoin miners. The case was later sent to arbitration.
Brothers charged by SEC for $60 million "crypto bot" Ponzi scheme
Brothers Jonathan and Tanner Adam were charged with violating the antifraud provisions of the federal securities laws with their GCZ Global and Triten Financial Group entities, which the SEC alleges amounted to a $61.5 million Ponzi scheme that impacted more than 80 victims. The brothers claimed to have a crypto arbitrage bot that would pull from investor funds to perform profitable trades that would earn them 8–13.5% returns. They claimed to investors that, short of a complete meltdown in global financial markets, their funds would be safe.
However, $53.9 million of investor funds were used to pay other investors, in classic Ponzi fashion. The brothers also used investor funds to build houses for themselves and their family, purchase vehicles and designer goods, and make payments on a $30 million condo in Miami for Tanner.
One of the brothers, Jonathan, had in 2004 been convicted on felony securities law violations that resulted in a four-year jail sentence and more than $300,000 in restitution.
- "SEC Charges Brothers Jonathan and Tanner Adam with $60 Million Ponzi Scheme", U.S. Securities and Exchange Commission [archive]
Abra crypto lender charged with securities violations, settles
The SEC charged the Abra cryptocurrency lending platform with failing to register the offers and sales of its retail crypto asset lending product, Abra Earn, and with operating as an unregistered investment company. Abra Earn was available to US customers from July 2020 until June 2023.
Abra settled the charges from the SEC by agreeing to an obey-the-law injunction, and agreeing to pay as-yet-undetermined civil penalties.
In January 2024, Abra settled claims from the Texas State Securities Board by agreeing to refund customers. As a part of the complaint, the TSSB had alleged that Abra was "insolvent or nearly insolvent", and had been making misleading statements. In June 2024, Abra settled with 25 state regulatory agencies, agreeing to refund up to $82.1 million to its US customers. Abra had begun winding down operations in the United States in mid-2023, after facing multiple state regulatory actions.
- "SEC Charges Abra with Unregistered Offers and Sales of Crypto Asset Securities", U.S. Securities and Exchange Commission [archive]
- "Crypto firm Abra reaches settlement with US states for operating without licenses", Reuters
Users suffer losses after Polygon Discord hack
Some fans of the Polygon blockchain, or those looking for help with using it, suffered losses after hackers successfully compromised the project's Discord server. Discord hacks have become a major issue in the cryptocurrency world, and although Polygon is one of the largest projects to suffer a Discord compromise, it's far from the only project to do so.
One member of the Discord described losing more than $140,000 in tokens after clicking a link shared by a person appearing to be a member of the Polygon team, which advertised a token distribution to serve as a "pre-migration celebration".
McDonald's Instagram hacked, hackers claim $700,000 haul
McDonald's Instagram account, as well as the Twitter account of a McDonald's marketing director, began promoting a memecoin called $GRIMACE (named for the restaurant chain's blobby purple mascot). The posts to McDonald's 5.1 million followers caused the token price to spike. Then, the attacker sold off their holdings, profiting around $700,000 and plunging the token price.
They then boasted about their haul on the compromised Instagram account, changing the bio to say: "Sorry mah nigga you have just been rug pulled by India_X_Kr3w thank you for the $700,000 in Solana 🇮🇳".
The token stunt by the massive company was perhaps made more believable by McDonald's previous forays into crypto, including when they launched a McRib-themed NFT project in December 2021. The company had also joked about a "Grimacecoin" back in January 2022, in a reply to a tweet from Elon Musk.