After a $230&nbsp;million "suspicious transfer", Indian cryptocurrency exchange WazirX has paused withdrawals and acknowledged that one of their <button class="define-target" id="multisig">multisignature</button> wallets was compromised. The attacker began selling off the tokens, causing the price of tokens like Shiba Inu to drop around 10%.<p>WazirX is the largest cryptocurrency exchange in India. The company was acquired by Binance in 2019, but the two companies re-separated in 2023 after a bizarre public dispute.</p><p>WazirX's June 2024 proof-of-reserves reported around $500&nbsp;million in total holdings, making the $235&nbsp;million theft a substantial portion of the assets held at the exchange.</p><p>Blockchain sleuth zachxbt observed that the theft had some of the hallmarks of the Lazarus Group, a North Korean hacking group that has perpetrated other 9-figure heists including the <a href="https://www.web3isgoinggreat.com/?id=axie-infinity-suffers-625-million-exploit" target="_blank">$625&nbsp;million <i>Axie Infinity</i> theft</a> in March 2022, and the <a href="https://www.web3isgoinggreat.com/?id=atomic-wallet-hacks-total-over-35-million" target="_blank">theft of more than $100&nbsp;million from Atomic Wallet users</a>.</p>

"India’s WazirX confirms security breach following a $230M ‘suspicious transfer’"

"WazirX Publishes June 2024 Proof of Reserves Report; Total Holdings Valued at Rs 4203 Cr."

WazirX hack

WazirX exchange hacked for $235&nbsp;million

The Ronin bridge, which <button class="define-target" id="bridge">bridges</button> crypto assets to the Ronin Network used by <i>Axie Infinity</i> and other gaming projects, has once again suffered a breach — though a considerably smaller one than the <a href="https://www.web3isgoinggreat.com/?id=axie-infinity-suffers-625-million-exploit" target="_blank">recordbreaking $625&nbsp;million theft</a> in March 2022. An update to the bridge code introduced a flaw with respect to how transactions were confirmed.<p>Fortunately for the Ronin team, it seems that most of the losses actually went to <button class="define-target" id="whitehat">whitehats</button> and <button class="define-target" id="mev">MEV</button> bots that were frontrunning transactions by would-be exploiters. ETH and USDC priced at around $12&nbsp;million were taken — the maximum amount before triggering a safety feature in the code. Later that day, Ronin announced that the ETH (worth around $10&nbsp;million) had been returned, and that the USDC was in the process of being returned. They also announced that they would reward the whitehats with a $500,000 bug bounty reward.</p><p>The Ronin bridge was taken offline shortly after the flaw was detected, and the team announced it would undergo an audit before being brought back online.</p>

"New Ronin Bridge hack down to dodgy upgrade, team banks on 'white hat' op"

"Ronin Bridge Paused, Restarted After $12M Drained in Whitehat Hack"

$12&nbsp;million taken by whitehats from Ronin bridge

Users of the cross-chain swapping API LI.FI Protocol, and of projects that build on top of it, suffered wallet drains amounting to at least $10&nbsp;million (and counting). An attacker was able to exploit the users who had set <a href="https://coinmarketcap.com/academy/glossary/infinite-approval">infinite approvals</a>. The protocol urged those who had interacted with several affected <button class="define-target" id="smart-contract">smart contracts</button> to revoke permission, and warned: "Please do not interact with any LI.FI powered applications for now!"

LI.FI exploit

Users of LI.FI protocol suffer losses of at least $10&nbsp;million

An apparent misconfiguration by the RHO Markets lending protocol allowed operators of an <button class="define-target" id="mev">MEV</button> bot to take $7.6&nbsp;million from the project's users across multiple chains.<p>In a stroke of luck for the RHO team, the MEV bot operator sent RHO an on-chain message indicating they were willing to return all of the funds, although they first demanded that RHO "admit that it was not an exploit or a hack, but a misconfiguration on your end. Also, please provide what you are going to do to prevent it from happening again."</p><p>RHO is built on the Scroll Ethereum <button class="define-target" id="layer-2">layer-2</button> network. Scroll temporarily paused the chain as RHO investigated the loss.</p>

Rho loss

RHO Markets lending protocol loses $7.6&nbsp;million to apparent whitehat

The operators of a project called ETHTrustFund on Coinbase's Base <button class="define-target" id="layer-2">layer-2</button> Ethereum blockchain have apparently rug-pulled the project. The ETHTrustFund project was a <button class="define-target" id="fork">fork</button> of the <a href="https://www.web3isgoinggreat.com/?collection=olympusdao" target="_blank">Olympus DAO</a> project on Base, but there was months of inactivity on the project following its March launch. Then, on July 20, the developer deleted his Telegram and Twitter accounts and the project's website, and suddenly moved the project treasury to a new wallet. The funds were then <button class="define-target" id="tumbler">laundered</button> through Railgun and Tornado Cash.

ETHTrustFund rug pull

ETHTrustFund rug pulls for $2.2&nbsp;million

Surprising just about no one, a wallet holding around 20% of the supply of the $DJT Trump-themed memecoin suddenly dumped its holdings, crashing the token price by around 90%. The token price had briefly spiked in June, when it was falsely reported that the token was "an official Trump token". However, the token's price had already dwindled since that time, and before the sudden dump.<p>People were quick to blame <a href="https://www.web3isgoinggreat.com/?id=martin-shkreli-claims-to-have-been-behind-a-donald-trump-memecoin" target="_blank">those behind the project</a>, primarily "Pharma Bro" Martin Shkreli (who has been <a href="https://www.web3isgoinggreat.com/?id=martin-shkreli-dumps-his-projects-token-in-hack" target="_blank">accused of dumping his own token before</a>). Shkreli was quick to shift the blame to Donald Trump's youngest son, Barron, who he has also claimed is behind the token (although this has not been independently confirmed). However, the owner of the wallet that dumped its tokens is not definitively known.</p>

"No one surprised as DJT token has finally rugged"

Trump-themed $DJT token rug-pulls, people blame Martin Shkreli or Barron Trump

The MonoSwap <button class="define-target" id="dex">DEX</button> announced on July 24 that it had been compromised, and urged its users to withdraw their funds to avoid losses. According to the project team, one of their developers had been lured into a call with someone pretending to be a venture capitalist, who convinced them to download what they claimed was video call software, but which instead was malware. MonoSwap claimed this gave the hackers "access to all MonoSwap-related wallets and contracts".<p>The malicious video chat software attack vector has been widely used in the crypto world, with a victim losing cryptocurrency to an <a href="https://www.web3isgoinggreat.com/?id=andreessen-horowitz-phishing" target="_blank">attacker using the same technique and impersonating an Andreessen Horowitz partner</a> last month.</p><p>So far, the MonoSwap attacker has laundered $1.3&nbsp;million via the Tornado Cash cryptocurrency <button class="define-target" id="tumbler">mixer</button>.</p>

MonoSwap hack

MonoSwap hacked for at least $1.3&nbsp;million

According to blockchain investigator zachxbt, North Korean developers using fake identities were able to steal $1.3&nbsp;million from a cryptocurrency project after pushing malicious code.<p>zachxbt traced the payment addresses for roughly 21&nbsp;developers involved in this kind of activity, which he found had been working for at least 25 different cryptocurrency projects. They had earned around $375,000 over the past month.</p>

7ANPW theft

North Korean developers steal $1.3&nbsp;million from crypto project treasury

In January 2023, Twitch streamer <a href="https://www.web3isgoinggreat.com/?id=dnp3-admits-to-gambling-with-investor-funds" target="_blank">DNP3 issued a statement admitting that he had gambled away investor funds</a> while chasing losses. "Eventually I lost everything. In addition to my own life savings, I also irresponsibly used investor funds to try and 'get my money back' from the casino," he wrote. He had founded crypto projects including CluCloin, the Gridcraft <button class="define-target" id="metaverse">metaverse</button> project, and the Goobers NFT project.<p>Now, Austin "DNP3" Taylor has pleaded guilty to wire fraud after stealing around $1.14&nbsp;million in investor funds from his CluCoin project, which had claimed it would "help others in need". DNP3 himself had built up a reputation of making generous gifts while livestreaming. He transferred the stolen funds to online casinos, where he then gambled them away.</p><p>Taylor faces up to 20 years in prison. The statement from the U.S. Attorney's Office announced that authorities would be notifying identified victims via NFT, and encouraging them to submit statements to the FBI.</p>

, U.S. Attorney's Office, Southern District of Florida

"Founder of Miami-Based Cryptocurrency Token CluCoin Pleads Guilty to Wire Fraud"

DNP3 pleads guilty to wire fraud after gambling away investor funds

Twitch streamer DNP3 pleads guilty to wire fraud after gambling away funds invested in crypto charity project

An attacker took advantage of a flaw in the code for the yield farming project ConvergenceFi, draining it of all the tokens that had been allocated for <button class="define-target" id="staking">staking</button> emissions. Because a function call in the <button class="define-target" id="smart-contract">smart contract</button> did not do proper validation, an attacker was able to provide their own smart contract that set the amount of tokens to return to anything they wanted. Naturally, the attacker set it to return all 58.7&nbsp;million tokens available to them, which they quickly swapped to around $210,000 and <button class="define-target" id="tumbler">laundered</button> through Tornado Cash.<p>Although ConvergenceFi described itself as <button class="define-target" id="audit">audited</button>, they admitted they had made changes to that portion of the code after the audits.</p><p>They assured their users that all user funds were safe, but recommended that users remove their staked funds from the platform.</p>

ConvergenceFi hack

ConvergenceFi hacked for $210,000

After encountering issues trading his cryptocurrency holdings on Coinbase, a man in his 60s decided to contact Coinbase support for help. He Googled "Coinbase" and clicked on a promoted result that displayed a Coinbase support phone number. After calling the number, the man was convinced to share his Coinbase password and to open his online banking account with the person on the other end, who was in fact a scammer impersonating Coinbase's customer support. By the time the man realized what was happening, thanks to a fraud alert from his bank, he had lost $100,000 in bitcoin, ether, and US dollars.<p>Scammers impersonating crypto company support representatives are everywhere on social media and elsewhere. Now, it seems, they are purchasing Google ads to rise to the top of Google search rankings. While Google says they attempt to remove fraudulent advertisers, some slip through the cracks.</p><p>While phishing attacks like this are prevalent both in crypto and in tradfi, crypto platforms often do not have similar safeguards as major banking platforms to try to thwart unauthorized transactions, nor do they have the same ability to reverse transactions that are made.</p>

"A Coinbase user thought he called customer support. Instead he lost $100,000 in 20 minutes to scammers"

Event	Date	Amount More info	Recovered More info
WazirX hack	July 18, 2024	$235,000,000
$12 million taken by whitehats from Ronin bridge	August 6, 2024	$12,000,000	$11,500,000
LI.FI exploit	July 16, 2024	$10,000,000
Rho loss	July 19, 2024	$7,600,000	$7,600,000
ETHTrustFund rug pull	July 20, 2024	$2,200,000
Trump-themed $DJT token rug-pulls, people blame Martin Shkreli or Barron Trump	August 6, 2024	$2,000,000
MonoSwap hack	July 24, 2024	$1,300,000
7ANPW theft	August 7, 2024	$1,300,000
DNP3 pleads guilty to wire fraud after gambling away investor funds	August 15, 2024	$1,140,000
ConvergenceFi hack	August 1, 2024	$210,000
Coinbase support scammer	August 15, 2024	$100,000