The Orbit Bridge project, a cross-chain <button class="define-target" id="bridge">bridge</button> for the Orbit Chain project, was exploited on December 31 for around $81&nbsp;million. The attacker made off with around 26,742&nbsp;ETH (~$64&nbsp;million) and $18&nbsp;million in the DAI <button class="define-target" id="stablecoin">stablecoin</button>. Orbit Chain's <button class="define-target" id="tvl">total value locked</button> plummeted from $152&nbsp;million to $71&nbsp;million as over half the funds were drained.<p>Orbit began sending the attacker on-chain messages, writing that "we will track you down and restore the damage you incurred to the ecosystem. And we will not stop." Orbit also wrote on Twitter that they were working with various law enforcement agencies.</p>

"Orbit Chain Loses $81M in Cross-Chain Bridge Exploit"

Orbit Bridge hack

Orbit Bridge hacked for $81&nbsp;million

Someone had a not so fun end to the year when they fell victim to a phishing attack and had around 275,700&nbsp;LINK drained from their crypto wallet. Those tokens are priced at around $4.4&nbsp;million.<p>The attack was perpetrated by the Pink Drainer group, which had recently compromised the Twitter account of Compound Finance to try to lure its more than 250,000 followers into authorizing the malicious drainer. It's not clear if that's how this wallet was drained, however, as Pink Drainer uses numerous strategies to attract victims.</p>

Wallet gets phished for $4.4&nbsp;million

$TEL, the token associated with the Telcoin remittances project, plunged 40% as an exploiter was able to steal around $1.25&nbsp;million from the project. The company later disclosed that the issue had to do with how the project had been implemented on the Polygon network. The app was taken offline as the company investigated the hack.<p>Telcoin later announced that they "plan[ned] to restore all wallets to their previous balances", though did not say whether or how they would be making up the $1.25&nbsp;million deficit.</p><p>Telcoin had been <button class="define-target" id="audit">audited</button> by CertiK, though CertiK tweeted to say that "this <button class="define-target" id="smart-contract">contract</button> was not in the scope of the audit conducted by CertiK".</p>

Telcoin exploit

Telcoin exploited for $1.25&nbsp;million

An attacker successfully <button class="define-target" id="oracle-manipulation">manipulated an oracle</button> to drain around 10% of the <button class="define-target" id="liquidity-pool">liquidity pool</button> for the Levana Protocol, an Osmosis-based perpetual futures project. This amounted to $1.146&nbsp;million.<p>The attack was unusual in that it lasted almost two weeks, going unnoticed because it was draining pools slowly enough that the Levana team assumed it was organic activity. However, when the network became congested, the attack suddenly became more profitable — and more noticeable.</p>

Levana Protocol exploit

Levana Protocol loses over $1.1&nbsp;million in slow motion

A new <button class="define-target" id="wallet-drainer">wallet drainer</button> tool has stolen $58.98&nbsp;million in cryptocurrency assets from more than 63,000 victims in the past nine months. People using the drainer software have pulled in victims by running ads on Twitter and through Google ads, employing various tricks to thwart ad reviewers trying to thwart malicious ads on their platforms.

MS drainer

New wallet drainer steals almost $60&nbsp;million in 9&nbsp;months

The Aurory gaming platform uses a <button class="define-target" id="bridge">bridge</button> called SyncSpace to move assets between the blockchain and the game's off-chain network. On December 17, the bridge was targeted on Arbitrum's Camelot <button class="define-target" id="dex">DEX</button>, and an attacker successfully siphoned around 600,000 $AURY tokens from the <button class="define-target" id="liquidity-pool">liquidity pool</button>. As a result, the pool went from around $1.5&nbsp;million in liquidity to around $312,000, and the price of the $AURY token dropped 11% as the attacker sold it off in bulk.<p>The Aurory team posted on Twitter to acknowledge the hack, writing that they'd disabled SyncSpace as they investigated. They also wrote that SyncSpace had been <button class="define-target" id="audit">audited</button> months ago, but that the audit had failed to detect the vulnerability.</p>

"Aurory’s USDC pool drained on Arbitrum’s DEX Camelot"

Aurory bridge hack

Aurory bridge hacked for over $1&nbsp;million

Attackers exploited old <button class="define-target" id="smart-contract">smart contracts</button> from the NFT Trader peer-to-peer <button class="define-target" id="nft">NFT</button> trading application to steal pricey NFTs, including at least 37 Bored Apes, 13 Mutant Apes, and NFTs from the VeeFriends and World of Women collections. Some ETH and APE tokens were also stolen. Altogether, the stolen NFTs are priced at around $3&nbsp;million, though the hacker may not be able to liquidate them for that ammount.<p>One attacker claimed in on-chain messages that the original attack had been perpetrated by someone else, but that they were one of the many copycat attackers, describing themselves as someone who had "[come] here to pick up residual garbage". They requested victims send <i>additional</i> ETH to get their NFTs back. "If you want the monkey nft back, then you need to pay me a bouty, which is what I deserve", they wrote, asking for NFT holders to send them 10% of the Ape floor price.</p><p>Meanwhile, NFT holders were urged to revoke access to NFT Trader, since the platform seemed aware of the attack but unable to stop it. NFT Trader was ultimately able to thwart the attacker to stem additional bleeding, likely thanks to help from community members who pointed out a way the contract could be shut down.</p><p>Later, the "residual garbage" attacker returned 36&nbsp;Bored Apes and 18&nbsp;Mutant Apes after a Yuga Labs co-founder paid the 120&nbsp;ETH (~$260,000) ransom.</p>

"NFT Trader hacked, millions of dollars in NFT stolen"

NFT Trader hack

"Top tier" NFTs stolen in NFT Trader hack

A <a href="https://en.wikipedia.org/wiki/Supply_chain_attack" target="_blank">supply chain attack</a> on the Ledger connector application has rippled throughout the world of <button class="define-target" id="dapp">decentralized apps</button>, which widely use the software to enable people to connect their popular Ledger <button class="define-target" id="hardware-wallet">hardware wallets</button> to perform transactions. Although hardware wallets are meant to be among the most secure ways to store crypto, they too are vulnerable to attacks when they are connected to perform transactions.<p>A hacker was able to obtain access to Ledger's source code management tool and push out a new release that contained code that would drain wallets as users connect them. Because the library is so widely used, many crypto applications were vulnerable — including Revoke.cash, a security-focused project intended to help people guard against attacks on their wallets.</p><p>CTO of the Sushi crypto project issued a broad warning: "Do not interact with ANY dApps until further notice." At least $600,000 has been drained from multiple users so far.</p>

Ledger supply chain attack

Supply chain attack on Ledger puts much of defi at risk

There was surprise in an Austrian courtroom when a defendant suddenly gave up any pretense of innocence, proclaiming, "I've run out of steam, I've finished driving... I plead guilty in full and ask for a lenient and speedy sentence". The judge then had to back up and understand what exactly he was pleading guilty to. The same defendant had earlier admitted to some guilt, but denied the fraud had been planned from the start. Later, he said that he had indeed planned from the beginning to steal the funds.<p>The scam in question was a Ponzi scheme  called EXW, in which the eight defendants stole at least €17.6&nbsp;million (~$19.3&nbsp;million) from at least 40,000 victims in late 2019 and 2020. The fraud later resurfaced under a different name. However, in court, the ex-girlfriend of the main defendant testified that the scam had actually brought in €80–100&nbsp;million ($88—$110&nbsp;million).</p><p>One of the defendants, who from reports seems to be the same one who just admitted his guilt in court, reportedly feigned being autistic when he was arrested by police, somehow earning himself enough time to erase the contents of his phone.</p><p>He and seven other defendants have been charged with fraud, money laundering, running a pyramid scheme, and operating a criminal organization.</p>

"EXW Wallet indictments, arrests &amp; criminal trial in Austria"

, <i>Salzburger Nachrichten</i> (in German)

"EXW-Prozess: Hauptangeklagter bekennt sich schuldig"

"Angeklagter bekennt sich im Prozess um Kryptobetrug vollumfänglich schuldig"

EXW fraud

Crypto scammer suddenly pleads guilty in trial surrounding EXW fraud

Many investors have reported losses thanks to a cryptocurrency investment scheme called HyperVerse, which operated in Australia from around 2018 to mid-2023. Several financial watchdogs issued warnings about the company, including the UK, Canada, Germany, and New Zealand. The Hungarian central bank warned in August 2022 that the HyperVerse project was a "suspected pyramid scheme... behind which there is no real economic activity... There is a significant chance that investors may permanently lose part or all of their invested capital."<p>Estimates by Chainalysis suggest that victims have lost a combined $1.3&nbsp;billion (with a B) to the scam thus far.</p><p>The scheme's operators Sam Lee and Zijing "Ryan" Xu were also behind <a href="https://web3isgoinggreat.com/?id=blockchain-global-enters-liquidation" target="_blank">Blockchain Global</a>, a collapsed company that operated the Australian ACX crypto exchange that collapsed in 2019. The company is in liquidation, and creditor claims are expected to surpass $50&nbsp;million. Although Lee and Xu were reported for investigation to the Australian Securities &amp; Investments Commission, ASIC did not take any action.</p><p>Lee has also been involved in other investment platforms, including two that are currently active: StableDao and We Are All Satoshi. Both platforms were the target of cease and desist letters from the Californian Department of Financial Protection and Innovation in September 2023, who described them both as "fraudulent pyramid and Ponzi scheme[s]".</p>

"Investors lose millions as crypto schemes operate unchecked in Australia"

"'They are so convincing': Vera Gazzard lost her life savings to HyperVerse"

"Crypto Scam Revenue Dropped 46% in 2022, While Blockchain Analysis Finds Links Between What Appear to be Distinct Scams"

"More than $50 million owed to creditors after collapse of Blockchain Global's cryptocurrency exchange"

HyperVerse scam

Australian victims lose estimated $1.3&nbsp;billion to prolific scammers' HyperVerse project

Four individuals who helped launder money through shell companies and various bank accounts have been charged in connection to an $80&nbsp;million "<button class="define-target" id="pig-butchering">pig butchering</button>" cryptocurrency scam. The scam reportedly involved at least 284&nbsp;transactions, though it's not clear how many victims were involved.

"Four Individuals Charged for Laundering Millions from Cryptocurrency Investment Scams"

$80&nbsp;million romance scam

Money launderers charged over $80&nbsp;million crypto romance scam 

OKX DEX is a service by OKX that aggregates <button class="define-target" id="dex">decentralized exchanges</button> (or DEXes) to help users access features and prices across multiple projects. On December 12, an attacker appeared to gain administrative control of the DEX's <button class="define-target" id="smart-contract">smart contract</button>. They upgraded the contract such that they could transfer tokens to themselves, then proceeded to do exactly that until they had stolen around $2.7&nbsp;million in various cryptocurrencies.<p>It appears the attacker was able to gain access to the smart contract admin <button class="define-target" id="private-key">key</button>, which gave them the ability to upgrade the contracts to enable malicious functionality.</p><p>OKX announced that they would reimburse the losses, and pursue legal action against the exploiter.</p>

"OKX DEX suffers $2.7M exploit after proxy admin contract upgrade"

OKX DEX hack

OKX DEX suffers $2.7&nbsp;million hack

Two fraudsters capitalized on the hype around both cryptocurrency and artificial intelligence, advertising an "artificial intelligence automated trading bot" that they promised would earn large returns for their investors. Instead, however, the fraudsters spent the money on themselves, paying for private chartered jet flights, luxury hotel accommodations, private mansion rentals, a personal chef, and private security guards.<p>In addition to pulling off the original scam, the fraudsters <i>also</i> came up with a fake investigative agency called the "Federal Crypto Reserve", where they directed victims who were seeking to recover their losses.</p><p>The scammers were charged with wire fraud, money laundering, and obstruction of justice, which carry hefty maximum prison terms.</p>

"Two Men Charged for Operating $25M Cryptocurrency Ponzi Scheme"

"AI-powered" crypto ponzi

Fraudsters steal more than $25&nbsp;million in "AI-powered" crypto ponzi

Periodically, Yearn Finance converts a small quantity of its treasury tokens into <button class="define-target" id="stablecoin">stablecoins</button> to spend on operations. However, something went terribly wrong during this process when they went to perform the swap and erroneously converted the entire amount — nearly 3.8&nbsp;million Ip-yCRVv2 tokens — into a stablecoin. According to one Yearn Finance employee, this pool of tokens comprised around 3% of the project's treasury.<p>Because there was not sufficient liquidity for such a large trade at the going price, the trade was ultimately fulfilled, but at a 63% loss. Before the trade, that quantity of tokens was priced at around $2.28&nbsp;million; however, Yearn received only around $780,000 in stablecoins because of the <button class="define-target" id="slippage">slippage</button>.</p><p>Yearn quickly identified the issue and embarked on a campaign to ask nicely for the counterparties in the trade to please give some of their profits back. In on-chain messages, Yearn wrote: "one of yearns <button class="define-target" id="multisig">multisigs</button> made a costly mistake last night that affected a critical source of yCRVs liquidity. we identified you as having made a profit off of this and are kindly requesting that you return as much as you see reasonable to yearns main multisig: ychad.eth. sorry we have to ask this, but hope you can understand." Doesn't hurt to ask, I guess. So far, only one wallet has taken them up on the offer, returning 2&nbsp;ETH (~$4,400).</p>

Yearn treasury swap

Yearn Finance accidentally swaps its entire Ip-yCRVv2 treasury, asks nicely for the money back

If you're named Rob Robb, do you have any choice but go into a life of thievery?<p>Robb, also known as "pokerbrat2019", convinced at least 11 people to give him a total of $1.2&nbsp;million, which he said he would use to develop various <button class="define-target" id="mev">MEV</button> bots. Instead of doing so, he pocketed the money, offering a litany of excuses for why the project was continually delayed.</p><p>Robb had previously been convicted of a $4&nbsp;million scam in 2002 after soliciting funds for an online gambling platform, instead using the money to buy a car and fund his own gambling.</p>

Rob Robb scam

Rob Robb robs victims of $1.2&nbsp;million

Users of the (not so) Safe Wallet have lost $2.05&nbsp;million altogether in the past week as they've been targeted by an attacker using an <button class="define-target" id="address-poisoning">address poisoning</button> attack. The same attacker was also behind such an attack on the Florence Finance real-world lending protocol, in which they stole $1.45&nbsp;million.<p>According to research group ScamSniffer, the attacker has stolen at least $5&nbsp;million from at least 21 victims in the past four months.</p>

Safe Wallet thefts

Users of the Safe Wallet lose cumulative $2&nbsp;million to address poisoning

An apparent <button class="define-target" id="address-poisoning">address poisoning</button> attack on the Florence Finance real-world asset lending protocol led to the loss of $1.45&nbsp;million in the USDC <button class="define-target" id="stablecoin">stablecoin</button>.<p>As of December 4, Florence Finance had not publicly acknowledged the theft.</p>

Florence Finance theft

Florence Finance loses $1.45&nbsp;million to address poisoning

A scam Hong Kong cryptocurrency platform called Hounax swindled its customers out of HK$148&nbsp;million (US$19&nbsp;million). The group drew in customers by offering financial expertise on social media and awarding prize money to those who signed up to the platform. While some customers successfully tested whether they could withdraw their funds earlier on, the platform later stopped allowing customers to withdraw, or told them they would need to pay additional fees to do so.<p>The Hong Kong Securities and Futures Commission added Hounax to its warning list on November 1, a move that victims have criticized as much too late to stop the damage.</p>

"Hounax scam: Hongkongers who lost HK$148 million to cryptocurrency platform say watchdog warning came too late"

Hounax scam

Hounax crypto scam steals $19&nbsp;million

A Bitcoiner making a large transaction ended up spending 83.64&nbsp;BTC (~$3&nbsp;million) of the 139.42&nbsp;BTC (~$5.1&nbsp;million) transaction on transaction fees, effectively spending $3&nbsp;million to send what ended up being a $2&nbsp;million transfer. This apparent error has become the largest transaction fee in Bitcoin history.<p>A person then claimed on Twitter to be the owner of the wallet, verifying the claim by signing a message from the wallet that paid the fee. They claimed that they had been hacked, and that an error on the attacker's part led to the huge fee payment. AntPool, the mining pool that mined that block and earned the huge fee, later agreed to return the fee, though it's not clear if or how they verified that the person to whom they're returning the fee wasn't in fact the attacker who had obtained control of the wallet.</p><p>A similar fee overpayment incident occurred in September, when the Paxos crypto firm erroneously paid a $500,000 fee to send $1,865. They attributed the huge fee to a bug in their software, and the F2Pool mining pool (who had mined the block and received the fee) opted to return the overpayment.</p>

"Bitcoin Sender Struck With $3.1M Transaction Fee, Largest in History"

"Bitcoin user claims to be victim of hack which led to record $3 million transaction fee"

Bitcoiner spends $3 million on transaction fee

Justin Sun confirmed that HTX (formerly Huobi) and its related Heco Chain protocol were hacked for a combined $115&nbsp;million. It's been a rough few weeks for Sun, whose <a href="https://web3isgoinggreat.com/?id=poloniex-hack" target="_blank">Poloniex exchange was hacked for around $120&nbsp;million</a> on November 10, and a rough few months for HTX, which was <a href="https://web3isgoinggreat.com/?id=huobi-exchange-hacked" target="_blank">hacked for $8&nbsp;million</a> in late September.<p>HTX suspended withdrawals as they investigated the hack, and wrote that the company would "fully compensate for HTX's <button class="define-target" id="hot-wallet">hot wallet</button> losses". Security firm Cyvers said they believed the theft was enabled by a <button class="define-target" id="private-key">private key</button> leak.</p>

"Justin Sun Confirms HTX, Heco Chain Exploited After $100M in Suspicious Transfers"

HTX and Heco Chain hack

HTX (fka Huobi) and Heco Chain hacked for $115&nbsp;million

The KyberSwap <button class="define-target" id="dex">decentralized exchange</button> was hacked by an attacker who stole large sums of ETH, <button class="define-target" id="wrapped-token">w</button>ETH, and the USDC <button class="define-target" id="stablecoin">stablecoin</button>. Altogether, the assets are valued at around $54.7&nbsp;million. The attacker was able to exploit a complex bug in a feature for <button class="define-target" id="liquidity-pool">liquidity pool</button> providers. Prior to the hack, KyberSwap had approximately $80&nbsp;million in <button class="define-target" id="tvl">TVL</button>.<p>Shortly after the attack, the thief sent a message: "Negotiations will start in a few hours when I am fully rested." The KyberSwap team later responded to offer a 10% bounty, also seeming to praise the attacker: "You have done one of the most sophisticated hacks ser. That was high EV and everyone missed it."</p><p>The thief had other plans, though, ultimately issuing a list of "demands" which included "complete executive control" over the company and "surrender of all ... assets" to the hacker. They wrote that they had big plans for the network, and although they planned to dismiss all executives, they wrote that employees would be offered double salaries to continue their work. The hacker signed the message "Kyber Director".</p><p>Meanwhile, KyberSwap regained around $4.7&nbsp;million after negotiations with the operators of <button class="define-target" id="front-running">front-running</button> bots, who agreed to return 90% of the funds they obtained through frontrunning the hacker's transactions.</p>

"KyberSwap offers 10% bounty to hacker following $47 million exploit"

"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations"

KyberSwap hack #2

KyberSwap hacked for $50&nbsp;million

At least according to the rather shady Tether stablecoin provider, the U.S. Department of Justice has been working on an investigation into a massive "<button class="define-target" id="pig-butchering">pig butchering</button>" romance scam and human trafficking operation based out of Southeast Asia.<p>According to Tether, they "voluntarily fr[oze] approximately 225 million in USDT tokens" in connection to the investigation.</p><p>Some romance scammers hoping to lure victims into sending them cryptocurrencies <a href="https://www.bloomberg.com/news/features/2023-08-17/my-crypto-hell-journey-started-with-a-wrong-number-scam-text" target="_blank">are themselves victims of human trafficking operations</a>, where they are held victim and forced to send such messages.</p>

"Following Investigations by Tether, OKX, and the U.S. Department of Justice, Tether Voluntarily Freezes 225M in Stolen USDT Linked to International Crime Syndicate"

Crypto romance scam in Southeast Asia

DOJ cracks down on $225&nbsp;million crypto romance scam

The cryptocurrency trading firm Kronos Research announced on Twitter that they had stopped trading while they investigated "unauthorized access of some of our API keys". They claimed that "potential losses are not a significant portion of our equity". They later confirmed the loss at around $26&nbsp;million.

Kronos breach

Kronos trading firm suffers key breach

Around 40% of the "insurance fund", intended to protect dYdX users from having to backstop other traders' losing trades, was drained in what dYdX CEO described as "pretty clearly a targeted attack against dYdX". An attacker manipulated the market for the Yearn Finance token, which is not normally heavily traded on dYdX, but which experienced a surge in trades around the attack. By taking advantage of flaws in dYdX's risk management, the attacker was able to rack up big losses and then force the dYdX insurance fund to pay out.

"dYdX’s insurance fund lost $9 million as a result of 'targeted attack': CEO"

dYdX insurance fund attack

dYdX insurance fund loses $9&nbsp;million in apparent attack

On the evening of November 14 I logged on to Twitter to notice that #OpenSeaHackAlert and related hashtags were trending. But they were trending not because OpenSea had truly been hacked, but because a huge network of fake accounts with usernames similar to those of PeckShield, CertiK, and zachxbt — well-known accounts that alert crypto traders to possible scams — were spamming the hashtag. Hoping to spark panic into crypto holders who had used the popular service, as well as other services like Uniswap which they were claiming were breached, the phishers shared links to sites that would supposedly help users revoke access to their wallets by those services, securing their assets. Instead, however, those malicious sites would drain the wallets.<p>According to researcher zachxbt, who himself was one of the impersonated, the scammers have stolen more than $300,000 in various assets using this technique.</p><p>This is not the first time such a technique has been used — a scammer attempted a similar, though less successful, <a href="https://web3isgoinggreat.com/?id=scammer-creates-a-fake-site-to-revoke-wallet-permissions" target="_blank">scheme</a> in April 2022. Scams like this take advantage of the poor UX in the crypto world for tracking and revoking wallet permissions that have been granted, requiring people to use third-party websites created for this purpose. Some of them are legitimate, but there are many malicious copies of these revocation sites that prey upon users who may be acting quickly in fear that their assets are at risk.</p>

Twitter security account impersonator scam

Network of fake Twitter accounts impersonating crypto security firms phish panicked victims

An attacker apparently stole $27&nbsp;million in the Tether <button class="define-target" id="stablecoin">stablecoin</button> from a <button class="define-target" id="wallet">wallet</button> that had just withdrawn the funds from their Binance account. The hacker quickly converted the funds to evade attempts at <button class="define-target" id="freezing">freezing</button> the stolen assets.<p>Crypto researcher zachxbt observed that the wallet targeted for the theft had in 2019 received a transfer from the Binance <button class="define-target" id="deployer">deployer</button>, suggesting that the compromised wallet may have some ties to Binance itself.</p>

Binance-linked wallet hacked

Wallet linked to Binance deployer loses $27&nbsp;million in apparent hack

A wallet <button class="define-target" id="drainer">drainer</button> service has facilitated the theft of more than $60&nbsp;million in various assets from almost 100,000 victims since May 2023. According to research group ScamSniffer, the drainer has recently started using functionality in the Ethereum network called <code>CREATE2</code> to generate new <button class="define-target" id="address">addresses</button> for each malicious <button class="define-target" id="signing">signature</button>. This allows the drainer to sidestep security alerts built into some crypto wallet software that would flag known malicious addresses.<p>ScamSniffer identified one victim who lost almost 17,000&nbsp;GMX (~$927,000) to this drainer after signing a malicious transaction.</p>

"Wallet Drainers Starts Using Create2 Bypass Wallet Security Alert"

Create2 wallet drainer

Wallet drainer steals more than $60&nbsp;million in six months

An attacker exploited the Raft <button class="define-target" id="defi">defi</button> project after finding a vulnerability that allowed them to <button class="define-target" id="mint">mint</button> 6.7&nbsp;million of Raft's R <button class="define-target" id="stablecoin">stablecoin</button> without any backing.<p>The attacker then went to convert the R into ETH, which they would then be able to launder and cash out. However, an error in the attacker's code caused 1,570&nbsp;ETH ($3.25&nbsp;million) to be sent to the <button class="define-target" id="burn">burn</button> address, rendering it permanently inaccessible to everyone including the hacker. Only 7&nbsp;ETH remained. However, because they had to spend ETH to fund the attack, the hack ultimately resulted in a <i>loss</i> of 4&nbsp;ETH (~$8,000) for the perpetrator. Oops.</p><p>As a result of the hack, the R stablecoin lost its dollar <button class="define-target" id="peg">peg</button>, plummeting down to around $0.70. Raft acknowledged the attack and announced that they had paused minting.</p>

"Raft Suffers $3.3M Exploit That Drove Down Stablecoin 50%, but Hacker Likely Lost Money on Attack"

Raft hack

Raft exploited for $3.3&nbsp;million, then hacker screws up

Assets including Bitcoin, Ethereum, and Tron's TRX token, priced at more than $126&nbsp;million, were stolen from Justin Sun's Poloniex cryptocurrency exchange. Researchers are still homing in on the exact amount of funds that were stolen from the company's <button class="define-target" id="hot-wallet">hot wallets</button> across multiple blockchains, but suffice to say it's a lot.<p>Poloniex was initially tight-lipped, posting on Twitter that they had "disabled for maintenance" an exchange wallet. Justin Sun later updated that they were investigating the "hack incident", and promised to "fully reimburse" the massive theft... somehow. He later tweeted that they would offer a 5% "<button class="define-target" id="bug-bounty">bounty</button>" to the hacker if they returned the funds within a week, threatening to "engage law enforcement" otherwise.</p>

"Justin Sun-Owned Exchange Poloniex Hacked for At Least $126 Million"

Poloniex hack

Poloniex hacked for more than $120&nbsp;million

The treasury of the Samudai <button class="define-target" id="dao">DAO</button> was apparently drained as an attacker compromised the project's <button class="define-target" id="multisig">multisignature</button> wallets and the wallet belonging to the project's founder, Kushagra Agarwal. Altogether, around $1.25&nbsp;million in ETH was stolen.<p>Agarwal sent a message to the thief shortly afterwards, offering a 10% "bounty" in exchange for the return of the rest of the funds. The attacker didn't seem to be interested, and in mid-January began <button class="define-target" id="tumbler">tumbling</button> the assets through the Tornado Cash cryptocurrency mixer.</p><p>Samudai didn't seem to publicly acknowledge the theft, even though they've posted on Twitter a few times since then. The organization had raised $2.5&nbsp;million in pre-seed capital in June 2022.</p>

Samudai treasury drained

The Australian cryptocurrency exchange CoinSpot appears to have been hacked for around 1,283&nbsp;ETH (~$2.4&nbsp;million). In two separate transactions, the ETH was transferred out of CoinSpot's <button class="define-target" id="hot-wallet">hot wallet</button>, then <button class="define-target" id="bridge">bridged</button> to Bitcoin via Thorchain and another bridge.

CoinSpot hack

CoinSpot exchange exploited

An <button class="define-target" id="mev">MEV</button> bot was exploited after an attacker discovered a vulnerability in its code that allowed anyone to call one of its functions that sold <button class="define-target" id="wrapped-token">w</button>BTC for wETH. Using a <button class="define-target" id="flash-loan">flash loan</button> to imbalance a wETH/wBTC <button class="define-target" id="liquidity-pool">pool</button> on Curve, the attacker then caused the bot to purchase wBTC at its inflated price. They then sold the wBTC for a profit. Altogether, the exploiter made off with 1,047&nbsp;ETH ($1.975&nbsp;million).

MEV bot 0x05f01 exploit

MEV bot exploited for almost $2&nbsp;million

Indian police have arrested around eighteen people, including four police officers, in connection with a $300&nbsp;million cryptocurrency scam that affected around 100,000 people in Himachal Pradesh. Victims were invited to invest in a cryptocurrency called Korvio Coin (KRO), but later the scam incorporated other tokens as well. Around 5,000 government officials and around 1,000 police fell victim to the scam, with some themselves becoming promoters.<p>The scam was allegedly orchestrated by Subhash Sharma, who has not been apprehended. This particular fraud was uncovered in September, but has been ongoing since as long ago as 2018.</p>

"Indian Police Arrest 8 More in $300M Crypto Scam: Report"

Himachal Pradesh scam

Arrests made in $300&nbsp;million Indian crypto scam

Monero's Community Crowdfunding System (CCS) funds projects that aim to improve the ecosystem of Monero, a <button class="define-target" id="privacycoin">privacycoin</button>. The CCS is funded by donations, and up until September 1, 2023, held a balance of 2675.73&nbsp;XMR (~$460,000). Two months after the fact, "Luigi" (a Monero developer and one of the two people with access to the wallet <button class="define-target" id="seed-phrase">seed phrase</button>) disclosed on Github that the <button class="define-target" id="wallet">wallet</button> had been drained entirely. According to Luigi, he only discovered this a month after the theft.<p>The other person with access to the wallet is a former Monero developer named "fluffypony", or Ricardo Spagni. He surrendered to US authorities in July 2023 for extradition to South Africa, where he has been charged with invoice fraud against  a cookie company (think chocolate chip, not software). However, he was released in late September, and has been working to "address this matter" while free but under court supervision.</p>

"Riccardo 'Fluffypony' Spagni Released by US Court, 'Actively Working' on Return to South Africa"

Monero community wallet hack

Monero discloses that its community crowdfunding wallet was drained

The Onyx Protocol was hacked for 1,164 ETH (~$2.1&nbsp;million) after an exploiter took advantage of a known vulnerability affecting forks of Compound Finance. The bug allows attackers to siphon funds from new and unfunded markets on Compound forks — in this case, a new pool that had been created for the PEPE token.<p>After pulling off the hack, the attacker received the usual flood of on-chain messages from people asking them to share some of their ill-gotten funds. Unusually, the attacker followed through, ultimately sharing 19.5&nbsp;ETH (~$36,000) out of their spoils.</p><p>Onyx is far from the first Compound fork to fail to patch known vulnerabilities and suffer hacks as a result. Hacks stemming from known Compound bugs, such as the attacks on <a href="https://www.web3isgoinggreat.com/?id=80-million-stolen-from-fei-protocol-and-rari" target="_blank">Rari Capital</a> and <a href="https://www.web3isgoinggreat.com/?id=sonne-finance-hack" target="_blank">Sonne Finance</a>, have netted tens of millions of dollars apiece for attackers in the past.</p>

"Onyx Protocol Hack Explained: A Deeper Dive Into $2.1M Exploit"

Onyx hack #1

Onyx hacked for $2.1&nbsp;million

A small <button class="define-target" id="defi">defi</button> protocol called Hope Lend was drained of nearly all its assets when attackers stole around 526&nbsp;ETH (~$825,000). Hilariously, the project claims the hacker was frontrun by a watchful third party, who paid half of the stolen funds (~264&nbsp;ETH, or around $414,000) to an ETH <button class="define-target" id="mining">validator</button> to allow them to frontrun the transaction. The original attacker who discovered the bug reportedly made no money at all.<p>The stolen assets represented the entire <button class="define-target" id="tvl">TVL</button> of the project.</p>

"Ethereum DeFi protocol Hope Lend drained after exploit"

Hope Lend hack

Hope Lend emptied in $825,000 hack

An attack targeting the Fantom Foundation and its employees siphoned $7&nbsp;million from wallets under their control. Of that, around $550,000 were funds belonging to the Fantom Foundation. One individual employee reportedly lost $3.4&nbsp;million.<p>It's not clear yet how the attack was perpetrated, although crypto researcher Spreek reposted a comment by an admin in Fantom's Telegram channel, where they blamed the theft on a zero-day exploit in Google Chrome.</p>

"Fantom Foundation confirms $550K loss in broader $7M attack"

Fantom wallet hacks

Fantom Foundation and employees lose collective $7&nbsp;million in mass hack

At this point, they should probably just have a form email ready to go. Platypus Finance has suffered a cumulative $2.23&nbsp;million in losses thanks to several attacks on the platform over the course of several hours. This set of hacks followed a <a href="https://web3isgoinggreat.com/?id=platypus-finance-stablecoin-exploited" target="_blank">$8.5&nbsp;million hack</a> in February, and another <a href="https://web3isgoinggreat.com/?id=platypus-finance-hack-2" target="_blank">hack</a> of at least $150,000 in July.<p>Platypus was quickly able to recover $575,000 from this latest hacker, thanks to a flaw in their attack. Later, they recovered all but $167,400 of the stolen funds after coming to an agreement with the attacker that they would not pursue legal action.</p>

"Platypus DeFi loses $2.2M in another flash loan exploit"

"How third hack of the year walloped Platypus Finance investors for $1.6m"

Platypus Finance hack #3

Platypus Finance hacked for a third time this year

The Black Hole Token project suffered a $1.28&nbsp;million apparent exploit, according to security firm PeckShield, though it's hard not to wonder if it might have been a <button class="define-target" id="rug-pull">rug pull</button>.<p>Black Hole Token is a Chinese project built on BNB Chain, which promises an original mechanism that only goes up. "The more you sell, the more the price goes up", promises their website.</p><p>Sounds legit.</p>

Black Hole Token hack

Black Hole Token exploited for $1.28&nbsp;million

The BNB Chain-based FSL token rug pulled within 24 hours of launching, with developers draining $1.68&nbsp;million of liquidity they had amassed.

FSL rug pull

FSL token rug pulls for $1.68&nbsp;million within 24 hours of launch

A <button class="define-target" id="metaverse">metaverse</button> gaming project called FinSoul promised users “sandbox worlds, multiplayer sports, leisure experiences, player socializing, MMORPG,” and other features. However, on October 10, the project team made off with $1.6&nbsp;million, which they then <button class="define-target" id="tumbler">tumbled</button> through Tornado Cash.<p>The team behind the FinSoul project was reportedly the same as the group who pulled off the much larger $31&nbsp;million <a href="https://web3isgoinggreat.com/?id=morgan-df-fintoch-likely-exit-scams-for-around-31-million" target="_blank">Fintoch exit scam</a> in May. They used similar strategies, including using paid actors to pose as their executive team, to push the FinSoul scam.</p>

"Web3 game project allegedly hired actors to pose as executives in $1.6M exit scam"

FinSoul exit scam

Fintoch scammers strike again with $1.6&nbsp;million FinSoul scam

Lucky Star Currency was an NFT-focused project released by a group claiming to be made up of astrologists. The group was heavily promoted on Chinese news and Q&amp;A platforms. However, not long after its release, the contract creator withdrew more than 1.6&nbsp;million&nbsp;LSC tokens and swapped them for approximately $1.1&nbsp;million.

"Astrology NFT project Lucky Star Currency rugged for over $1M — CertiK"

Lucky Star Currency rug pull

Astrology-themed NFT project Lucky Star Currency rug pulls for $1.1&nbsp;million

Stars Arena, an Avalanche-based dupe of the popular Friend.Tech project, suffered a serious exploit in which an attacker drained tokens priced at around $3&nbsp;million.<p>Avalanche co-founder and CEO Emin Gün Sirer drew widespread mockery when announcing that "the amount lost is only $3m", apparently not perceiving that $3&nbsp;million is a massive sum to most people. He also didn't mention that it constituted almost the entire total <button class="define-target" id="tvl">TVL</button> of the Stars Arena project, which was left with less than $1 in tokens following the attack.</p><p>Stars Arena was fortunate, in that the hacker ultimately contacted them offering to make a deal. The attacker returned 90% of the funds, keeping $300,000 as a "<button class="define-target" id="bug-bounty">bounty</button>".</p>

"Avalanche Social App Stars Arena Drained of $3M in AVAX After Hack"

Stars Arena exploit

Stars Arena exploited for $3&nbsp;million

After agreeing to allocate $500,000 to "MMM" (merchandise, memes, and marketing — no, really), Gitcoin screwed up sending the money so badly that it's gone forever. Whoever was in charge of making the transfer accidentally pasted the Gitcoin contract address into the recipient field, rendering the tokens permanently inaccessible. Such mistakes can be devastating, and yet are very common in the crypto world, where transfers are irreversible.

"Gitcoin DAO gaffe sees $500,000 in GTC tokens lost forever"

Gitcoin transfer mistake

Gitcoin loses $500,000 in transfer SNAFU

The <button class="define-target" id="defi">defi</button> staking and lending project BigWhale announced that the <button class="define-target" id="private-key">private key</button> to one of their crypto wallets had been leaked, and 7,200&nbsp;BNB (~$1.5&nbsp;million) had been stolen.<p>In a long post on Twitter, the project promised "we will refund all investor funds down to the last cent". They also wrote that "Not only are we going to use the fullest extent of the law to go after the person or persons behind this hack / attack, we will also use ALL OTHER MEANS NECESSARY - and we do have such resources at our disposal, to go after the ones who are behind this. (We work with assets within the Russian government directly...)"</p><p>In a later post on their website, however, they wrote that they do "not bear legal liability to refund investors for the losses incurred unless the hacked funds are successfully recovered", attributing the incident to <i>force majeure</i>. They repeatedly claimed that they had not been involved in the theft. The project completely took down its website, redirecting it to this post.</p> 

"Legal Statement Regarding Hacking Incident"

BigWhale hack

BigWhale loses $1.5&nbsp;million in private key leak

After the Hong Kong-based JPEX exchange limited withdrawals amidst what appeared to be an <a href="https://web3isgoinggreat.com/?id=jpex-issues" target="_blank">impending collapse of the platform</a>, things are now looking a lot more like fraud.<p>Police have received more than 2,200 complaints pertaining to the exchange, involving $191&nbsp;million (and counting) in possible losses. Eleven people, including various crypto influencers who had promoted the exchange, were taken in for questioning. However, police have said those eleven people were not likely central to the fraud, and that the leaders of the JPEX project are on the run.</p><p>According to the <i>South China Morning Post</i>, "The alleged case of financial fraud involving HK$1.37 billion is the largest of its kind in Hong Kong's history."</p>

"Hong Kong JPEX scandal: who are the suspects arrested so far and how are they tied to cryptocurrency platform?"

JPEX collapse

JPEX appears to be a $191&nbsp;million fraud

Justin Sun confirmed on September 25 that his crypto exchange Huobi (recently rebranded to "HTX") had been hacked for 5,000&nbsp;ETH ($8&nbsp;million) the prior day. He reassured customers that the exchange would be covering the shortfall, and that "all user assets are <button class="define-target" id="safu">#SAFU</button>".<p>Sun offered a <button class="define-target" id="bug-bounty">bounty</button> to the hacker to return 95% of the funds, also promising to hire them as a "security <button class="define-target" id="whitehat">white hat</button> advisor" for the exchange. Otherwise, he threatened to go to law enforcement.</p><p>Two weeks later, the thief returned the funds, with a note that their <button class="define-target" id="hot-wallet">hot wallet</button> <button class="define-target" id="private-key">key</button> had leaked. Huobi paid the $410,000 bounty.</p>

Huobi exchange hacked

Huobi exchange hacked for $8&nbsp;million

The operators of the Mixin Network disclosed that hackers had stolen around $200&nbsp;million in funds in the largest known hack of the year (to date). Mixin Network is a cross-chain project that boasts zero transaction fees.<p>In their announcement, Mixin wrote that "the database of Mixin Network's cloud service provider was attacked by hackers", leading to some confusion as Mixin is supposed to be a decentralized network that ostensibly shouldn't <i>have</i> a centralized cloud database.</p><p>Mixin announced they would be suspending deposits and withdrawals pending analysis of the incident. They also told users that they would be compensated "up to a maximum of 50%" on assets that had been stolen from them, and receive "tokenized liability claims" (that is, IOUs) for the rest.</p>

Mixin Network hack

Mixin Network discloses $200&nbsp;million hack

Someone lost over $4.4&nbsp;million of the Tether stablecoin after falling victim to a <button class="define-target" id="phishing">phishing</button> scam that promised them fake <button class="define-target" id="mining">mining</button> rewards. A phisher lured in the victim, likely earning their trust and then promising high returns thanks to a "mining" operation. Typically, these projects fool their victims by showing them a growing balance on the platform's software, even as the phishers drain their wallets.<p>These types of scams draw in tens of millions of dollars each month, and one researcher has estimated around $350&nbsp;million in Tether have been stolen in these types of scams since September 2021.</p>

"USDT Approval Mining, Liquidity Mining &amp; Sha Zhu Pans"

0x5e422 phishing attack

Wallet phished for $4.46&nbsp;million in fake mining scam

Balancer issued an urgent warning to stop using its web interface, as it was evidently compromised by malicious actors who redirected the funds to themselves. Within 30 minutes of the tweeted warning, $240,000 had already been stolen.<p>This is the second theft from Balancer in a month, after it <a href="https://web3isgoinggreat.com/?id=balancer-vulnerability" target="_blank">warned of a critical vulnerability</a> on August 22, and that <a href="https://web3isgoinggreat.com/?id=balancer-exploit" target="_blank">vulnerability was exploited</a> for around $2&nbsp;million several days later.</p>

Event	Date	Amount More info	Recovered More info
Orbit Bridge hack	December 31, 2023	$81,000,000
Wallet gets phished for $4.4 million	December 28, 2023	$4,400,000
Telcoin exploit	December 26, 2023	$1,250,000
Levana Protocol exploit	December 26, 2023	$1,146,000
MS drainer	December 21, 2023	$58,980,000
Aurory bridge hack	December 17, 2023	$1,188,000
NFT Trader hack	December 16, 2023	$3,000,000
Ledger supply chain attack	December 14, 2023	$610,000
EXW fraud	December 13, 2023	$19,300,000 – $110,000,000
HyperVerse scam	December 13, 2023	$1,300,000,000
$80 million romance scam	December 13, 2023	$80,000,000
OKX DEX hack	December 12, 2023	$2,700,000
"AI-powered" crypto ponzi	December 12, 2023	$25,000,000
Yearn treasury swap	December 11, 2023	$1,500,000	$4,400
Rob Robb scam	December 4, 2023	$1,200,000
Safe Wallet thefts	December 3, 2023	$5,000,000
Florence Finance theft	November 30, 2023	$1,450,000
Hounax scam	November 27, 2023	$19,000,000
Bitcoiner spends $3 million on transaction fee	November 23, 2023	$3,000,000
HTX and Heco Chain hack	November 22, 2023	$115,000,000
KyberSwap hack #2	November 22, 2023	$54,700,000	$4,700,000
Crypto romance scam in Southeast Asia	November 20, 2023	$225,000,000
Kronos breach	November 18, 2023	$26,000,000
dYdX insurance fund attack	November 18, 2023	$9,000,000
Twitter security account impersonator scam	November 14, 2023	$300,000
Binance-linked wallet hacked	November 12, 2023	$27,000,000
Create2 wallet drainer	November 12, 2023	$60,000,000
Raft hack	November 11, 2023	$3,300,000
Poloniex hack	November 10, 2023	$126,000,000
Samudai treasury drained	November 10, 2023	$1,250,000
CoinSpot hack	November 8, 2023	$2,400,000
MEV bot 0x05f01 exploit	November 7, 2023	$1,975,448
Himachal Pradesh scam	November 6, 2023	$300,000,000
Monero community wallet hack	November 1, 2023	$460,895
Onyx hack #1	November 1, 2023	$2,100,000
Hope Lend hack	October 18, 2023	$825,000
Fantom wallet hacks	October 17, 2023	$7,000,000
Platypus Finance hack #3	October 12, 2023	$1,655,000	$1,487,600
Black Hole Token hack	October 11, 2023	$1,280,000
FSL rug pull	October 10, 2023	$1,680,000
FinSoul exit scam	October 10, 2023	$1,600,000
Lucky Star Currency rug pull	October 9, 2023	$1,100,000
Stars Arena exploit	October 7, 2023	$3,000,000	$2,700,000
Gitcoin transfer mistake	October 6, 2023	$500,000
BigWhale hack	October 3, 2023	$1,500,000
JPEX collapse	September 25, 2023	$191,000,000
Huobi exchange hacked	September 24, 2023	$8,000,000	$8,000,000
Mixin Network hack	September 23, 2023	$200,000,000
0x5e422 phishing attack	September 20, 2023	$4,458,326
Balancer frontend compromise	September 19, 2023	$237,932