One month after pausing customer withdrawals, crypto lending firm Celsius Network filed for Chapter 11 bankruptcy. Celsius had recently hired a new group of restructuring lawyers from Kirkland &amp; Ellis, the same group <a href="https://web3isgoinggreat.com/?id=voyager-digital-files-for-bankruptcy" target="_blank">counseling Voyager Digital in their bankruptcy proceedings</a> announced on July 6.

"Crypto Lender Celsius Files for Bankruptcy After Cash Crunch"

"Troubled Crypto Lender Celsius Hires New Restructuring Lawyers"

Celsius collapse

Celsius files for bankruptcy

Voyager Digital, a crypto broker that <a href="https://web3isgoinggreat.com/?id=voyager-digital-suspends-withdrawals-and-other-activity" target="_blank">suspended withdrawals</a> a week prior, announced that it had filed for bankruptcy. They attributed their decision to "prolonged volatility and contagion in the crypto markets", as well as their exposure to Three Arrows Capital, an also-bankrupt crypto fund that <a href="https://web3isgoinggreat.com/?id=voyager-digital-reduces-withdrawal-limit" target="_blank">defaulted on a loan</a> from Voyager worth around $660&nbsp;million.<p>Voyager CEO Stephen Ehrlich wrote on Twitter that he expected that Voyager would "emerge as a stronger company", certainly an optimistic prediction  for a crypto broker that froze customer funds with no promise they will ever be able to access them, then filed for bankruptcy.</p>

"Voyager Digital Commences Financial Restructuring Process to Maximize Value for All Stakeholders"

Voyager Digital bankruptcy

Voyager Digital files for bankruptcy

Babel Finance, a crypto lender that <a href="https://web3isgoinggreat.com/?id=babel-finance-suspends-withdrawals-and-redemptions" target="_blank">suspended withdrawals</a> in mid June, sustained "massive losses" thanks to its proprietary trading desk, which was trading with customer funds. According to a restructuring plan viewed by Bloomberg, Babel's prop desk lost around 8,000&nbsp;BTC and 56,000&nbsp;ETH, valued at around $225&nbsp;million at the time of the loss. The trading team was not using risk controls, and their unhedged position led to forced liquidations that made Babel's lending and trading departments unable to meet its margin calls from counterparties like <a href="https://web3isgoinggreat.com/?id=zipmex-indefinitely-halts-withdrawals" target="_blank">Zipmex</a>.

"Troubled Crypto Lender Babel Lost Big While Trading Client Funds"

Babel Finance collapse

Restructuring plans reveal Babel Finance's $225&nbsp;million losses during crypto market dip

Crypto lending firm Vauld, which <a href="https://web3isgoinggreat.com/?id=crypto-lender-vauld-suspends-withdrawals" target="_blank">suspended withdrawals</a> and announced they were considering restructuring on July 4, have disclosed to their creditors a shortfall of around $70&nbsp;million. They explained this was due to mark-to-market losses relating to the declining pricess of Bitcoin, Ether, and Polygon, as well as exposure to the now-collapsed Terra stablecoin UST. They also attributed some of the shortfall to longterm loans that can't be called back for another 3–11 months.<p>Several weeks prior, <a href="https://web3isgoinggreat.com/?id=vauld-lays-off-30-of-workforce-and-slashes-executive-pay" target="_blank">Vauld had cut 30% of staff, slashed executive salaries, and began various other cost-cutting measures</a>.</p><p>Rival firm Nexo has said it is considering acquiring Vauld, though some have expressed skepticism that Nexo is in a position to afford such an acquisition.</p>

"Vauld issues letter to its creditors, disclosing $70 million shortfall"

Vauld deficit revealed

Vauld is short around $70&nbsp;million

The FBI's Cyber Division issued a notification about fraudulent cryptocurrency investment apps that are successfully being used to defraud American investors. The scammers typically claim to offer cryptocurrency investment services to their targets, then convince them to download mobile apps that resemble genuine crypto trading apps (sometimes mimicking actual exchanges). The apps typically show the users' accounts increasing in value, but when users try to withdraw funds they find they're unable. Sometimes the apps defraud their victims even further by claiming they need to pay an additional "tax" before they can withdraw.<p>The FBI stated they had identified 244&nbsp;victims, and estimated the total loss associated with these fraudulent apps to be around $42.7&nbsp;million.</p>

"Cyber Criminals Create Fraudulent Cryptocurrency
Investment Applications to Defraud US Investors"

FBI warns of malicious crypto apps

FBI warns of fraudulent crypto apps that have stolen an estimated $42.7&nbsp;million

According to <i>Seoul Economic Daily</i>, the Korean cryptocurrency investment fund Uprise lost 99% of its customer funds when they tried to <button class="define-target" id="short">short</button> Luna during <a href="https://web3isgoinggreat.com/?id=terra-luna-token-drops-in-price-by-98-amidst-ongoing-terrausd-stablecoin-collapse" target="_blank">its collapse in May</a>. Although Luna crashed in price from around $90 to fractions of a cent, brief price spikes were enough to wipe out Uprise's positions. The firm lost 99% of its customers' funds, or ₩26.7&nbsp;billion ($20.5&nbsp;million), as well as an additional ₩3.9&nbsp;billion ($3&nbsp;million) of its own money.<p>The firm advertised its AI-enabled automatic trading strategies, which it said would reduce the risk involved with leveraged crypto trading.</p><p>A spokesperson for Uprise stated, "It is true that damage to customer assets has occurred due to unexpected great volatility in the market."</p>

"Uprise lost 99% of client funds while shorting LUNA during its price crash: SE Daily"

, <i>Seoul Economic Daily</i> (in Korean)

[단독] '카카오·KB 베팅' 코인투자사, 루나로 267억 날렸다

Uprise collapse

Report reveals that crypto investment firm Uprise lost 99% of customer funds trying to short Luna during its collapse

20.8&nbsp;million&nbsp;BUSD, a dollar-pegged stablecoin on BNB Chain, was transferred from Raccoon Network and the Freedom Protocol on July 19. Security firm PeckShield identified the incident as a scam perpetrated by the people running the projects, although Raccoon Network has tried to claim the transfers were the result of a hack.<p>Raccoon Network is a <button class="define-target" id="metaverse">metaverse</button> project. Freedom Protocol invested in the project in late June, and announced they would be working together. Freedom Protocol is a <button class="define-target" id="defi">defi</button> project that advertises an 183,394.2% <button class="define-target" id="apy">APY</button> "compounded by scientific calculations".</p>

Raccoon Network and Freedom Protocol rug pull

$20&nbsp;million taken from Raccoon Network and Freedom Protocol in likely rug pull

Solana liquidity protocol Crema Finance was exploited for around 69,500&nbsp;SOL (~$2.3&nbsp;million) and around $6.5&nbsp;million worth of <button class="define-target" id="stablecoin">stablecoins</button> for a total loss of around $8.8&nbsp;million. The hacker then swapped the stablecoins for Ethereum via Uniswap.<p>Crema Finance sent a message to the hacker via Ethereum transaction, writing that "you have 72h from now to consider becoming a white hat and keeping $800k as the <button class="define-target" id="bug-bounty">bounty</button>... Otherwise the police and legal force will officially get involved and there will be endless tracing waiting for you." On July 6, Crema announced that they had reached an agreement with the hacker, who returned most of the funds and kept 45,455&nbsp;SOL ($1.68&nbsp;million) as a "bounty".</p><p>Although the terms of the "bounty" agreement suggested that Crema Finance would not involve law enforcement, sometimes these things are out of platforms' hands (or they renege on the agreement). On July 11, 2023, the U.S. Attorney for the Southern District of New York announced charges against Shakeeb Ahmed, a security engineer alleged to have perpetrated the theft.</p><p>Crema Finance is not to be confused with <a href="https://web3isgoinggreat.com/?collection=cream" target="_blank">C.R.E.A.M. Finance</a>, a crypto lending service that was hacked three separate times in 2021 for a total of nearly $200&nbsp;million.</p>

, U.S. Attorney's Office, Southern District of New York

"Former Security Engineer For International Technology Company Arrested For Defrauding Decentralized Cryptocurrency Exchange"

Crema Finance hack

Crema Finance hacked for $8.8&nbsp;million, most returned

In a successful, broadly-targeted <button class="define-target" id="phishing">phishing</button> campaign, more than 70,000 addresses connected to Uniswap were <button class="define-target" id="airdrop">airdropped</button> tokens that baited users into approving transactions that allowed attackers to control their wallets. After some initial confusion that there might be a vulnerability in Uniswap itself, it was determined that the thefts were being perpetrated through the airdrop, which also linked users to a website that resembled the authentic Uniswap site. Users were tricked into signing the contract, and cryptocurrency and NFTs were stolen from wallets.<p>One single wallet targeted by the phishing attack lost more than $6.5&nbsp;million worth of Ether and Bitcoin, and another targeted by attackers lost around $1.68&nbsp;million worth of those currencies.</p>

"Someone Lost Millions Trying to Claim $2K Crypto Airdrop"

Uniswap phishing attack

More than $8.17&nbsp;million stolen in phishing attack targeting Uniswap users

The Teddy Doge <button class="define-target" id="defi">defi</button> project saw its token price plummet over 99% as 30&nbsp;billion&nbsp;TEDDY were transferred from the project's deployer and distributed to various wallets, which then converted the TEDDY to over 10,000&nbsp;BNB ($2.56&nbsp;million) and 2&nbsp;million&nbsp;BUSD, a dollar-pegged <button class="define-target" id="stablecoin">stablecoin</button>.<p>Although the project admins blamed the theft on an outside attacker, writing on Telegram that they were "not certain whether it is a bug in our cross-chain bridge or a leaked developer wallet", that is a common refrain by developers who <button class="define-target" id="rug-pull">rug pull</button> their own projects.</p>

"Meme Coin Teddy Doge 'Soft' Rug Pulls $4.5M Worth of Tokens, PeckShield Says"

Teddy Doge rug pull

$4.5&nbsp;million taken from Teddy Doge project in apparent rug pull

The Solana-based <button class="define-target" id="yield-farming">yield farming</button> project, Nirvana Finance, was exploited by an attacker who used <button class="define-target" id="flash-loan">flash loans</button> to drain the project of just under $3.5&nbsp;million. The attacker took out a $10&nbsp;million loan from the Solend project, used it to <button class="define-target" id="mint">mint</button> ANA tokens, swapped the ANA for $13.5&nbsp;million, and then repaid the loan. The attack was similar to the <a href="https://web3isgoinggreat.com/?id=crema-finance-hacked-for-8-8-million" target="_blank">attack on Crema Finance</a> earlier in the month.<p>The attack caused the project's ANA token to plunge in value by 80%, and the project's NIRV stablecoin to lose its dollar peg, falling to $0.08. Nirvana Finance tweeted, "Please be advised: ANA has lost its collateral, and NIRV has lost its peg.  Until the thief restores funds, these tokens will not have exchange value. Be very careful with trading NIRV &amp; ANA, as they currently have no guaranteed value."</p><p>They also tweeted at the hacker, promising to stop investigating the hacker's identity and to pay a $300,000 "<button class="define-target" id="bug-bounty">bounty</button>" in exchange for the funds back. They wrote, "You have not taken money from VCs or large funds — the treasury you have taken represents the collective hopes of everyday people."</p><p>The project had promised its users over 60%&nbsp;<button class="define-target" id="apy">APY</button>, and its Twitter account described ANA as "the balanced risk investment with adaptive yield".</p>

"Solana DeFi Protocol Nirvana Drained of Liquidity After Flash Loan Exploit"

"Solana-based Nirvana loses $3.5M to flash loan exploit; tokens tank 90%"

Nirvana Finance hack

Nirvana Finance drained of $3.5&nbsp;million

Crypto sleuth zachxbt has accused the NFT project "Boneheads" of rug pulling only weeks after the project <button class="define-target" id="mint">minted</button> in August 2021. Although they promised physical collectibles, more NFT collections, merch giveaways (including, of all things, <i>rugs</i>), and other perks, they never followed through.<p>zachxbt traced the funds to various centralized crypto exchanges, and also found that some of the money had been used to purchase other pricey NFTs including Bored Apes, CryptoPunks, and others. He also identified two individuals he suspected were behind the pseudonymous creators of the project, who had mysteriously begun posting luxury trips, designer purchases, and an expensive Mercedes after the project mint.</p><p>After zachxbt's thread, the project tweeted for the first time in a very long time, writing "for the 2736463266474th time, itz not rug 😪, just a very deliberately slow creative process, lots of pivots..." However, the project never followed through on their promised new deadline. The social media account showing evidence of the alleged creator's lavish spending was also deleted.</p>

Boneheads rug pull

Boneheads rug pull for $3.1&nbsp;million

Bifrost is a platform that allows developers to create <button class="define-target" id="dapp">dApps</button> across multiple blockchains. They run the service BiFi, which is a <button class="define-target" id="defi">defi</button> platform built atop Bifrost. On July 10, they inadvertently exposed the key to their Bitcoin address-issuing server. An attacker was able to use this to self-sign their own deposit address, then make a fake deposit into the BiFi Bitcoin lending service in exchange for 1,852&nbsp;ETH ($2.25&nbsp;million).<p>Bifrost wrote in their post-mortem analysis that because the attack was limited to the BTC address registration server, and the hack didn't exploit any <button class="define-target" id="smart-contract">smart contract</button> or protocol vulnerabilities, a security <button class="define-target" id="audit">audit</button> performed by Theori "is still valid" — leading one to wonder why anyone should trust an "audited" platform if $2.25&nbsp;million in assets can be stolen without invalidating an audit.</p>

"Post-mortem: BiFi-BTC illegal address registration"

Bifrost hack

More than $2.25&nbsp;million stolen from Bifrost's BiFi platform

Hackers used a <button class="define-target" id="flash-loan">flash loan</button> attack to steal around 1,300&nbsp;ETH ($1.43&nbsp;million) from the NFT lending platform Omni. Omni allows users to borrow cryptocurrency against their NFTs.<p>Hackers used NFTs from the popular Doodles collection as collateral to borrow <button class="define-target" id="wrapped-token">w</button>ETH, then withdrew all but one of the NFTs, allowing them to perform a re-entrancy attack. The attacker then laundered the funds using the Tornado Cash cryptocurrency <button class="define-target" id="tumbler">tumbler</button>.</p><p>According to Omni, only funds belonging to the platform that were being used for testing were taken by the attacker.</p>

"Hacker drains $1.4 million worth of ETH from NFT lender Omni"

Omni hack

Hackers steal $1.43&nbsp;million from Omni NFT lending platform

An attacker was able to create and pass a governance proposal to transfer out 18.5&nbsp;million AUDIO tokens from the community treasury. They then successfully swapped these for 705&nbsp;ETH (~$1.1&nbsp;million).<p>Audius halted the token and <button class="define-target" id="smart-contract">smart contracts</button> while they patched the bug, and brought the network back online shortly afterward. The attacker had found and exploited a vulnerability in the way the contracts were written which allowed them to rewrite the governance voting rules and delegate 10&nbsp;trillion AUDIO tokens to themselves for voting purposes. They then used those tokens to pass the malicious proposal. The contracts had been <button class="define-target" id="audit">audited</button> by OpenZeppelin and Kudelski, but neither group caught the vulnerability. Audius stated that a plan for dealing with the loss of community funds was still under discussion.</p>

"Audius Governance Takeover Post-Mortem 7/23/22"

Audius governance attack

Attacker makes off with $1.1&nbsp;million after successful governance attack on the Audius web3 music platform

PREMINT is an NFT service intended to help project creators build access lists for new NFT projects based on various qualifications. The project was compromised on July 17, and users were asked to sign transactions that allowed hackers to drain all assets from their wallets. 314 NFTs were stolen, including from pricey collections such as Bored Ape Yacht Club, Otherside, Moonbirds Oddities, and Goblintown. The thiefs were able to flip the stolen NFTs for 270&nbsp;ETH ($375,000), which they then <button class="define-target" id="tumbler">tumbled</button> through Tornado Cash.<p>On July 20, PREMINT's CEO announced they would be compensating all users affected by the hack by sending them ETH equivalent to the <button class="define-target" id="floor-price">floor price</button> of the stolen NFTs. "I realize that the NFTs stolen were not all floor NFTs... You might feel like this compensation isn't enough. But I don't think there's any other scalable and objective way to do this," he said. The total repayment will amount to about 340&nbsp;ETH ($525,000). PREMINT also bought the two most expensive stolen NFTs from their new owners for the prices they had paid to buy them from the hacker —  92&nbsp;ETH ($138,000) for a Bored Ape and 12&nbsp;ETH ($17,800) for an Azuki. Those NFTs were returned to their original owners.</p>

"A hacker stole $375,000 from users of Premint NFT platform"

"Premint to Return $500K in Ethereum to NFT Hack Victims"

PREMINT hack

PREMINT NFT tool hacked, user wallets drained

Bored Ape aficionado franklinisbored has apparently found a new source of entertainment by placing high bids on his own ENS domains with amusing names, causing a Twitter bot that announces ENS domain offers to tweet about it. After amusing himself by placing 100&nbsp;ETH bids on joebiden.eth, elonmusk.eth, barackhusseinobama.eth, and donaldjtrumpjr.eth, he solicited suggestions on Twitter for what ENS domain he should create and then place a fake bid on next.<p>Based on a follower's suggestion, he created the ENS domain stop-doing-fake-bids-its-honestly-lame-my-guy.eth and placed a 100&nbsp;ETH bid on it. To his surprise, another person came along and offered him 1.9&nbsp;ETH (~$2,900). Apparently excited to receive a sizeable offer for a gag NFT, franklinisbored accepted the offer and took to Twitter to write about his good fortune: "Well this is the most surprising 1.891 ETH I have ever made. I owe it all to #ENS and @gweiman_eth's creative idea. #Marketing101".</p><p>Meanwhile, he had forgotten to cancel his joke 100&nbsp;ETH offer, which remained active. The new buyer accepted the offer and sold the NFT back to him, pocketing 98&nbsp;ETH in the process. Franklinisbored wrote on Twitter, "I was celebrating my joke of a domain sale, sharing the spoils, but in a dream of greed, forgot to cancel my own bid of 100 ETH to buy it back. This will be the joke and bag fumble of the century. I deserve all of the jokes and criticism." He also sent the 1.9&nbsp;ETH back to the other person, with a message asking them to reverse the transaction. The other person replied, "No, thank you for the money though."</p>

Franklin joke loss

NFT collector Franklin loses 100&nbsp;ETH (~$150,000) in a joke gone wrong

On July 16, hackers compromised the Twitter account belonging to the well-known NFT artist DeeKay, who sold an NFT for 310&nbsp;ETH (then $1&nbsp;million) to Snoop Dogg in April. The 180,000 followers of DeeKay's compromised Twitter account saw it post a link announcing a new limited quantity <button class="define-target" id="airdrop">airdrop</button>, which directed them to a website mimicking DeeKay's real site. Some people fell for the scam, and in trying to claim their NFTs, actually approved transactions that allowed the scammers to empty their wallets. One victim lost four Cool Cat NFTs and three Azuki NFTs, which have <button class="define-target" id="floor-price">floor prices</button> of around 4&nbsp;ETH (~$5,350) and 12&nbsp;ETH (~$16,200) respectively.<p>Altogether, the stolen NFTs were valued at around $150,000. DeeKay reported that he wasn't sure how his Twitter account had been compromised, but that "my guess is that [two-factor authentication] was off for that specific time". DeeKay wrote that he was considering compensating his followers who were victim to the scam, but that "[a] few are pretending to be affected and looking for opportunities", and "this also encourages hackers to keep doing their thing". "There were some kind souls who were affected and have shown me great flexibility for me to compensate in different ways. Some are asking for high demands as if I was the hacker...😪", he wrote in the thread.</p>

"Hacker Targets NFT Artist DeeKay’s Twitter, Wipes NFTs Worth $150K"

DeeKay Twitter hack

NFTs valued at $150,000 stolen via phishing link posted to the hacked Twitter account of NFT artist DeeKay

Quixotic, an NFT marketplace on the Optimism network, was attacked after a hacker was able to exploit a recently updated <button class="define-target" id="smart-contract">smart contract</button>. The attacker made off with at least $100,000.<p>Quixotic is the largest NFT marketplace on Optimism, a <button class="define-target" id="layer-2">layer 2</button> Ethereum network. Despite being the largest marketplace on the network, it still does fairly little in volume compared to NFT marketplaces on other networks, boasting only around $420,000 in trading volume in the last 30 days.</p><p>Quixotic paused marketplace activity after discovering the hack, and promised to reimburse all users who had tokens stolen from them.</p>

"Optimism NFT marketplace Quixotic suffers exploit following contract update"

Quixotic NFT marketplace hack

Quixotic NFT marketplace hacked for more than $100,000

Citizen Finance, a multichain platform that has something to do with NFTs and blockchain gaming, claimed to have suffered an attack by an outside party who obtained access to a private key for the BNB and Polygon chains. The attacker then used their access to transfer 244&nbsp;BNB (~$55,000), 57,637&nbsp;MATIC (~$32,300), and 7,000&nbsp;USDC for a total windfall of around $94,300. The theft also caused the value of the CIFI token to plummet more than 50%.<p>As with many of these attacks, it's not immediately clear if there was truly an outside party who gained unauthorized access, or if the "attack" was actually a <button class="define-target" id="rug-pull">rug pull</button> or an inside job. The project tweeted on July 16 that they were "continu[ing] to investigate" and had hired outside security firms to try to help them identify the hacker and recoup lost funds.</p>

Event	Date	Amount More info	Recovered More info
Celsius collapse	July 13, 2022	~$1,700,000,000 shortfall
Voyager Digital bankruptcy	July 6, 2022	~$430,000,000 shortfall
Babel Finance collapse	July 29, 2022	$225,000,000
Vauld deficit revealed	July 11, 2022	~$70,000,000 shortfall
FBI warns of malicious crypto apps	July 18, 2022	$42,700,000
Uprise collapse	July 6, 2022	$23,500,000
Raccoon Network and Freedom Protocol rug pull	July 19, 2022	$20,816,856
Crema Finance hack	July 2, 2022	$8,800,000	$7,120,000
Uniswap phishing attack	July 11, 2022	at least $8,167,500
Teddy Doge rug pull	July 25, 2022	$4,500,000
Nirvana Finance hack	July 28, 2022	$3,500,000
Boneheads rug pull	July 14, 2022	$3,100,000
Bifrost hack	July 10, 2022	$2,253,606
Omni hack	July 10, 2022	$1,430,000
Audius governance attack	July 23, 2022	$1,101,343
PREMINT hack	July 17, 2022	$680,800
Franklin joke loss	July 20, 2022	$150,646
DeeKay Twitter hack	July 16, 2022	$150,000
Quixotic NFT marketplace hack	July 1, 2022	$100,000
Citizen Finance hack	July 11, 2022	$94,300