An Ethereum <button class="define-target" id="wallet">wallet</button> was apparently drained of 1,155&nbsp;<button class="define-target" id="wrapped-token">wrapped</button> bitcoin (~$72.7&nbsp;million) when they transferred it to a malicious address that had been operating an <button class="define-target" id="address-poisoning">address poisoning</button> scheme.<p>Address poisoning is a scam tactic that takes advantage of crypto traders' tendencies to copy and paste wallet <button class="define-target" id="address">addresses</button> from their transaction histories, since the addresses are long strings of characters that are not practical to type from memory. By creating a new wallet address with identical start and/or ending character strings to addresses used by the victim, and spamming the victim with transactions from that similar address, scammers are sometimes able to get victims to erroneously copy the spoofed address for future transfers.</p><p>That's what appears to have happened in this case, when a victim transferred 1,155 wrapped bitcoin — tokens pegged to the bitcoin price meant for use on the Ethereum blockchain — to the malicious address.</p><p>The victim and the exploiter later reached an agreement for the return of most of the funds, with the exploiter keeping $7.2&nbsp;million as a "<button class="define-target" id="bug-bounty">bounty</button>".</p>

0x1E227 address poisoning

Wallet loses over $72&nbsp;million to address poisoning

Hedgey Finance, a platform used to manage token claims, lockups, and vesting, was hit with a <button class="define-target" id="flash-loan">flash loan</button> attack that drained $44.7&nbsp;million of customer funds from the platform.<p>The majority of assets were stolen from Hedgey on the Arbitrum <button class="define-target" id="layer-2">layer-2</button> network, although around $2.1&nbsp;million of them were stolen from the version deployed on the Ethereum mainnet.</p><p>Hedgey Finance confirmed the exploit, and sent an optimistic and congratulatory message on-chain: "Well done for finding it! We're assuming you executed this exploit as a <button class="define-target" id="white-hat">white hat</button>, so we'd like to get in touch with you to discuss next steps." No on-chain response thus far.</p>

Hedgey Finance hack

Hedgey Finance hacked for almost $45&nbsp;million

A project promising to build a decentralized casino managed to raise $33&nbsp;million, despite an anonymous team that had exhibited several instances of shady behavior throughout ZKasino's development. The project promised that everyone who <button class="define-target" id="bridge">bridged</button> ETH to their <button class="define-target" id="layer-2">layer-2</button> chain would be able to receive their ETH back 1:1 in thirty days.<p>Instead, the project's creators transferred those more than 10,500 ETH ($33&nbsp;million) to Lido, an Ethereum <button class="define-target" id="staking">staking</button> service. As for the "return" of funds, the project team indeed followed through with their promises to return the crypto... except instead of ETH, depositors received the project's native token, ZKAS, which would vest over a period of 15 months. The project announced that they had calculated the ZKAS distribution based on a discounted rate, "as a favour to our users who have bridged to participate in the ecosystem". Gee, thanks!</p><p>One investor in the project wrote, "We made a mistake investing in Zkasino early. ... [I]t sounds like a scam, but 95% of crypto consists of such crap. With memecoins pumping every day, people believe this could be the next one."</p><p>It seems that ZKasino's creators have links to other crypto scams, including a failed "ZigZagExchange", which raised around $15&nbsp;million that was allegedly misallocated to work on the ZKasino project. Crypto sleuth zachxbt had also described the team as "proven bad actors" in December, listing multiple instances in which they had avoided making promised payments.</p><p>After the rug pull, the project's planned IDO on Ape Terminal and AIT Launchpad were canceled, and MEXC (which had invested in the project's seed round) canceled the token listing.</p>

"ZKasino Users Plead for Refunds as $33M of Bridged Ether Sent to Lido"

"ZKasino launch leads to widespread outrage as $33 million promised to investors is sent to Lido"

ZKasino rug pull

ZKasino rug pulls after raising $33&nbsp;million

Two brothers, Anton and James Peraire-Bueno, were indicted for a theft involving <button class="define-target" id="mev">MEV</button> — maximal extractable value. MEV involves previewing upcoming transactions on a blockchain and taking actions to extract additional profits — which can sometimes be substantial — based on that information.<p>According to the Justice Department, the Peraire-Buenos exploited a flaw in popular MEV software called "MEV-boost", which is used by most Ethereum <button class="define-target" id="validator">validators</button>. By creating their own validators and "bait transactions", they were able to trick MEV bots into proposing transactions involving illiquid cryptocurrencies, which the brothers then frontran. They were able to create false signatures that tricked a MEV-boost relay into releasing information about upcoming blocks that they were able to tamper with.</p><p>The brothers were charged with conspiracy to commit wire fraud, wire fraud, and conspiracy to commit money laundering, and face up to 20 years in prison for each charge.</p><p>The Justice Department is describing the case as a "first-of-its-kind manipulation of the Ethereum blockchain". The case is an interesting one, as some believe the practice of MEV itself exploits Ethereum users. Others believe anything you can do with code should be allowed — "code is law". However, by signing false transactions and tricking the relay into releasing private information, the brothers' actions do seem to go beyond simply making profits in a "code is law" Wild West, and into the realm of actual fraud.</p>

, press release by the U.S. Department of Justice

"Two Brothers Arrested for Attacking Ethereum Blockchain and Stealing $25M in Cryptocurrency"

Peraire-Bueno MEV indictment

Brothers indicted for $25&nbsp;million MEV bot exploit

The Sonne Finance lending protocol was exploited for at least $20&nbsp;million as an attacker was able to exploit a vulnerability in some of their <button class="define-target" id="smart-contract">smart contracts</button>. Sonne is a <button class="define-target" id="fork">fork</button> of the Compound Finance project, which has known vulnerabilities that are sometimes not properly addressed by people who reuse the code — as has happened with <a href="https://www.web3isgoinggreat.com/?id=radiant-capital-hack" target="_blank">Radiant Capital</a> and <a href="https://www.web3isgoinggreat.com/?id=80-million-stolen-from-fei-protocol-and-rari" target="_blank">Rari</a>.<p>After being alerted to the theft by several security companies, Sonne announced they had paused the contract on the Optimism Ethereum <button class="define-target" id="layer-2">layer-2</button> chain.</p>

Sonne Finance hack

Sonne Finance hacked for at least $20&nbsp;million

Bahrain-based cryptocurrency exchange Rain was exploited for around $14.8&nbsp;million dollars on April 29. The exchange did not publicly disclose the hack until the suspicious outflows across <button class="define-target" id="wallet">wallets</button> on multiple blockchains were noticed by blockchain investigator zachxbt.<p>After zachxbt sounded the alarm on May 13, Rain admitted that they had had a "security incident", but stressed that customer funds were safe, and stated that the Rain Group had "covered any potential losses resulting from this incident".</p>

Rain cryptocurrency exchange hacked for $14.8&nbsp;million

Jay Mazini, an influencer who often boasted of his wealth on Instagram by doing cash giveaways to random strangers, has been sentenced to seven years in prison after running "overlapping fraud schemes" that scammed victims out of at least $8&nbsp;million. One of them involved a multi-million dollar cryptocurrency scam in which he would promise to pay higher prices for crypto, and would convince those who were interested to transfer their funds to him by providing doctored images of wire transfer confirmations to suggest that he'd fulfilled his end of the deal.<p>Mazini also ran a scam targeting the Muslim community in New York, via a company called Halal Capital. In reality, this was a Ponzi scheme, and payouts to his investors were funded in part by the crypto scam he was also running.</p><p>Mazini was arrested in March 2021 on kidnapping charges, after he kidnapped and beat someone who might have witnessed his frauds. He was sentenced to five years in prison for that charge, to which he pled guilty. His new fraud sentence will be served concurrently with the kidnapping sentence.</p><p>In addition to seven years in prison, Mazini has been ordered to forfeit $10 million. Restitution has not yet been determined.</p>

, U.S. Attorney's Office, Eastern District of New York

"Instagram Influencer Known as 'Jay Mazini' Sentenced to 84 Months in Prison for Overlapping Fraud Schemes"

"Serial Scammer and Instagram Influencer Jay Mazini Pleads Guilty"

Jay Mazini sentenced

Instagram influencer Jay Mazini sentenced to seven years in prison for crypto fraud

An attacker tried to pull off what could have been a ~$12&nbsp;million heist from ALEX Lab's XLink bridge after a <button class="define-target" id="private-key">private key</button> was compromised. However, the sloppy work by the attacker enabled an apparent <button class="define-target" id="whitehat">whitehat</button> hacker to step in.<p>The attacker was successfully able to transfer around 13.8&nbsp;million STX (~$2 million) on the Stack BTC <button class="define-target" id="layer-2">layer-2</button> chain. However, their attempts to steal assets notionally worth around $4.3&nbsp;million from the project's BNB Chain implementation failed when they upgraded the project <button class="define-target" id="smart-contract">contract</button> to a malicious version, but failed to prevent <i>other</i> people from calling the withdraw function. The attacker's first transactions to withdraw the funds themself failed, and an apparent whitehat hacker was able to step in and complete the withdrawal ahead of the exploiter. They later negotiated a deal for the funds' return, after offering a 10% "<button class="define-target" id="bug-bounty">bounty</button>".</p><p>The exploiter had also tried, and failed, to steal assets notionally worth around $5&nbsp;million on the Ethereum blockchain, but failed to do so. ALEX Lab later announced they were able to recover or secure around $4.5&nbsp;million of those assets. ALEX also later announced that they believed the attackers were part of the North Korean Lazarus Group.</p>

ALEX XLink bridge theft

$2&nbsp;million stolen from ALEX's XLink bridge by bumbling exploiter

Pike Finance, a cross-chain lending protocol, was exploited twice in four days as attackers discovered vulnerabilities in the project's <button class="define-target" id="smart-contract">smart contracts</button>.<p>The first attack, on April 26, was enabled by a flaw in the security measures related to transfers of the USDC stablecoin. An attacker was able to change the recipient address and amount, ultimately making off with almost $300,000 in the stablecoin. Pike released a postmortem two days later, acknowledging that the bug had been identified by a third-party <button class="define-target" id="audit">auditor</button> but had not been rectified by their team.</p><p>When the Pike team went to patch the smart contracts to thwart this attack, they introduced new, even worse vulnerabilities. As a result, on April 30, an attacker was able to upgrade the project's smart contracts to malicious ones, then withdraw $1.68&nbsp;million in ETH, ARB, and OP tokens.</p><p>Pike Finance has offered a 20% reward for the return of the funds or information pertaining to the attacker, and has promised "a plan to make users whole". Pike, which launched in early 2024, is backed by Circle and Wormhole.</p>

"Post-Mortem Report: Pike USDC Withdrawal Vulnerability"

Pike Finance hacks

Pike Finance exploited for $2&nbsp;million in two separate attacks

An exploiter was able to create a fake version of the $GNUS token on the Fantom blockchain, then bridge the tokens to Ethereum and Polygon where they were then sold as though they were authentic. They were able to drain $1.27&nbsp;million from the project's liquidity pools.<p>GNUS.ai (short for "Genius", not a reference to the animal) is one of many AI-related blockchain projects that has sprung out of the recent AI hype. This particular one promises to allow people to "utiliz[e] unused cycles" on various computing devices for computation-intensive AI systems, using cryptocurrency for payments.</p>

GNUS.ai exploi

GNUS.ai exploited for $1.27&nbsp;million

After the founder of the Solana-based Cypher <button class="define-target" id="derivative">futures</button> trading protocol publicly accused a core contributor of stealing funds, the contributor — publicly known only as "hoak" — has confessed to the thefts.<p>Cypher was <a href="https://www.web3isgoinggreat.com/?id=cypher-protocol-exploit" target="_blank">hacked</a> for $1&nbsp;million in August 2023, but was able to recover around $600,000 of the stolen funds, which they promised to distribute to impact users via a redemption fund. However, over a period of months and unbeknownst to the rest of the team, hoak had been dipping into the recovered funds — taking around half of what was in the fund for himself.</p><p>After he was accused, hoak fessed up in a public statement where he wrote that his actions were a "culmination of what snowballed into a crippling gambling addiction and probably multiple other psychological factors that went by unchecked for too long." He continued: "I know likely nothing I say or do will make things better - perhaps other than rotting in jail. To address the elephant in the room, the allegations are true, I took the funds and gambled them away. I didn’t run away with it, nor did anyone else."</p>

Event	Date	Amount More info	Recovered More info
0x1E227 address poisoning	May 3, 2024	$72,700,000	$65,500,000
Hedgey Finance hack	April 19, 2024	$44,700,000
ZKasino rug pull	April 20, 2024	$33,000,000
Peraire-Bueno MEV indictment	May 15, 2024	$25,000,000
Sonne Finance hack	May 14, 2024	$20,000,000
Rain cryptocurrency exchange hacked for $14.8 million	April 29, 2024	$14,800,000
Jay Mazini sentenced	April 24, 2024	$8,000,000
ALEX XLink bridge theft	May 14, 2024	$6,300,000
Pike Finance hacks	April 30, 2024	$2,000,000
GNUS.ai exploi	May 5, 2024	$1,270,000
Cypher contributor theft	May 13, 2024	$316,294