On December 7, the Harmony blockchain began encountering a bug that ultimately caused around 150&nbsp;million of the project's $ONE token (priced at around $2.2&nbsp;million) to be erroneously <button class="define-target" id="mint">minted</button> and distributed to 79 <button class="define-target" id="wallet">wallets</button>. Most of the recipients, who were anonymous, quickly sold their unexpected windfall.<p>The bug was fixed about a week later. There has been a dispute since then between Harmony employees and a consultant who was involved in identifying the bug, and the consultant has been accused of delaying action to profit from the excess tokens. The consultant also balked at destroying some of the tokens he mistakenly received.</p><p>The consultant claims that he didn't profit from the bug, and objected to a Harmony employee coming after him to destroy the excess tokens when he'd done little towards others who profited from the error. He did, however, say later that he had destroyed the tokens.</p><p>According to the consultant, a Harmony employee claimed that he had filed reports to the FBI and IRS about the consultant's behavior, and had the consultant banned from the annual ETH Denver event.</p>

"Inside the Harmony spat over a bug that created $2.2m in tokens"

Harmony infinite mint bug

Harmony blockchain encounters "infinite mint" bug; accusations of wrongdoing fly

A trader looking to buy $9&nbsp;million of a recently popular Solana <button class="define-target" id="memecoin">memecoin</button>, dogwifhat (WIF), lost $5.7&nbsp;million of their funds to <button class="define-target" id="slippage">slippage</button> as they placed a massive order in a <button class="define-target" id="liquidity-pool">pool</button> with relatively low liquidity. $5.7&nbsp;million of their funds were lost to "slippage" — the discrepancy in price that can occur when a trade is so large or a market is so illiquid that the trade itself impacts the asset price.<p>Some have speculated that the trade might be an expensive marketing stunt to increase attention to WIF, which was losing some steam.</p><p>I'll give it to them: the token's namesake is pretty cute. But not $9&nbsp;million cute.</p>

"Trader Buys $9M of Solana Meme Coin Dogwifhat, But Loses Over 60% to Slippage"

dogwifhat slippage

Trader loses $5.7&nbsp;million to slippage in memecoin trade

As Euler Finance tried to recover from a <a href="https://web3isgoinggreat.com/?id=euler-finance-exploited-for-almost-200-million" target="_blank">massive hack</a> in March 2023, and as founder co-founder Michael Bentley was dealing with matters in his personal life, he "made an error and it turns out that one of the <button class="define-target" id="private-key">private keys</button> [to his personal crypto <button class="define-target" id="wallet">wallet</button>] is no longer recoverable". The private key would have allowed him to recover assets from his <button class="define-target" id="hardware-wallet">hardware wallet</button>, which had made his assets inaccessible after a malfunction.<p>With the malfunctioning hardware wallet and no recovery key, Bentley has lost access to assets including 1.2&nbsp;million EUL tokens — over 4% of the total EUL token supply. These tokens are priced at about $3.8&nbsp;million today, though at other times the tokens would have been worth up to about $15&nbsp;million.</p><p>"I've now lost a substantial percentage of the crypto assets I held in <button class="define-target" id="cold-wallet">cold storage</button>, accumulated over more than seven years, including the majority of the EUL allocated to me for participating in Euler governance," said Bentley.</p>

"Euler co-founder lost $3.8m worth of governance tokens after hardware failure"

Euler Finance private key loss

Euler Finance cofounder loses private key and, with it, $3.8&nbsp;million

The creator of a Solana-based NFT project called Undead Apes Society has been charged with money laundering conspiracy and making false statements to investigators after rug-pulling fans of his NFT project. Devin Rhoden, an active duty Senior Airman in the US Air Force, had created the project and minted two collections: UndeadApes and Undead Lady Apes. They promised to then mint a third collection, "Undead Tombstones", which was highly anticipated. However, the project turned out to be a rug pull, and the prices of the two previous collections also plummeted as a result of their connection to a scam project. The Undead Tombstones project raised 1,250&nbsp;SOL in April 2022, which was at the time priced at around $128,000.<p>When investigators subpoenaed Discord for Rhoden's chat logs, they found messages celebrating the rug pull. "good shit on us making a fuck ton of money," he wrote to his co-conspirator.</p>

"Undead Apes" rug pull

"Undead Apes Society" creator charged over rug pull

A cryptocurrency project called Narwhal appears to have <button class="define-target" id="rug-pull">rug-pulled</button>, claiming that they were hacked. In a post on their Twitter account, they claimed that a "hacker attack" caused "significant losses to [their] community members", but urged followers to "maintain trust in the platform".<p>However, investigation by the CertiK blockchain security firm suggests that the "hack" may have been an inside job, with much of the $1.5&nbsp;million that was "stolen" going to wallets with links to the Narwhal team.</p><p>The Narwhal project had launched in mid-December.</p>

Narwhal exit scam

Narwhal likely exit scams for $1.5&nbsp;million

A Solana <button class="define-target" id="yield-farming">yield farming</button> project called MangoFarmSOL encouraged people to deposit Solana tokens into the protocol to earn airdrops by January 10. However, on January 6, the project appeared to make off with all the tokens — around $2&nbsp;million worth. They subsequently deleted their website and Twitter account, and closed their Telegram channel to new members.<p>MangoFarmSOL is unrelated to the other Solana-based mango-themed project, Mango Markets, which was <a href="https://web3isgoinggreat.com/?id=mango-markets-suffers-hack" target="_blank">exploited in October 2022</a> for more than $100&nbsp;million.</p>

"Funds on MangoFarmSOL drained, community alleges rug pull"

MangoFarmSOL rug pull

MangoFarmSOL rug pulls for $2&nbsp;million

The crypto payments platform CoinsPaid was hacked for the second time in six months. This time, around $7.5&nbsp;million in various tokens was stolen.<p>In July 2023, an <a href="https://web3isgoinggreat.com/?id=coinspaid-suspends-withdrawals" target="_blank">attacker stole $37.3&nbsp;million</a> from the CoinsPaid platform. CoinsPaid said at the time that they suspected the attacker was the North Korean Lazarus hacking group, which has been a prolific perpetrator of cryptocurrency thefts.</p>

CoinsPaid hack #2

CoinsPaid hacked again

The xKingdom project promised users a way to "build your kingdom" on Twitter, earning tokens by interacting with tweets and doing "quests". Users had to borrow XKING tokens in order to participate.<p>On January 6, the project's creators drained the tokens that had been put into the project, then deleted their website and social media accounts. Altogether, they withdrew 558.3&nbsp;ETH (~$1.25&nbsp;million).</p>

xKingdom rug pull

xKingdom rug pulls for $1.25&nbsp;million

The Gamma Strategies <button class="define-target" id="defi">defi</button> protocol suffered an exploit when an attacker targeted their vaults on several projects across the Arbitrum <button class="define-target" id="layer-2">layer-2</button> network. The attacker successfully stole almost $6.2&nbsp;million from these vaults by manipulating the price of some of the assets involved.<p>Gamma has contacted the hacker to try to negotiate a return of some of the assets, and also says they have engaged law enforcement. Although they have promised to try to repay some of the stolen assets, they are estimating between 25% and 40% recoveries for various categories of users.</p>

"DeFi protocol Gamma Strategies suffers an estimated $3.4 million exploit"

Gamma Strategies exploit

Gamma Strategies exploited for $6.2&nbsp;million

Bill Lou, the co-founder of a cryptocurrency wallet that claims to "revolutionize wallet security", was scammed out of 52&nbsp;stETH (~$125,000) when he clicked a link promising an <button class="define-target" id="airdrop">airdrop</button> for a project. However, he had fallen for a phishing link that was prominently placed in Google search results, mimicking a real project but draining users' wallets when they authorized the transaction.<p>"I just got scammed out of $125k of stEth while trying to claim the $LFG airdrop. And I'm a fking founder of a wallet startup that's trying to improve wallet security..." wrote Lou on Twitter. "This is the first time I've been scammed. I always read about others but you never think it could happen to you..." he wrote.</p><p>If the founder of a wallet security project can't avoid scams in the crypto world, what hope do the rest of us have?</p>

Bill Lou scammed

Wallet security startup founder scammed out of $125,000

Radiant Capital, a cross-chain lending protocol built on the Arbitrum <button class="define-target" id="layer-2">layer-2</button> network, was hacked for 1,900&nbsp;ETH (~$4.5&nbsp;million). The exploit relied on a flaw in the underlying code, which was forked from Compound and Aave. The original code has a known rounding issue, which makes new projects vulnerable to attack shortly after they are deployed if they are not specifically configured to avoid the issue. In this case, the attacker had observed the <button class="define-target" id="smart-contract">contract</button> being deployed and performed the exploit only six seconds after the project was activated.<p>Radiant Capital sent an on-chain message to the attacker, offering to negotiate a <button class="define-target" id="bug-bounty">bounty</button>.</p>

Radiant Capital hack

Radiant Capital lending protocol hacked for $4.5&nbsp;million

The Orbit Bridge project, a cross-chain <button class="define-target" id="bridge">bridge</button> for the Orbit Chain project, was exploited on December 31 for around $81&nbsp;million. The attacker made off with around 26,742&nbsp;ETH (~$64&nbsp;million) and $18&nbsp;million in the DAI <button class="define-target" id="stablecoin">stablecoin</button>. Orbit Chain's <button class="define-target" id="tvl">total value locked</button> plummeted from $152&nbsp;million to $71&nbsp;million as over half the funds were drained.<p>Orbit began sending the attacker on-chain messages, writing that "we will track you down and restore the damage you incurred to the ecosystem. And we will not stop." Orbit also wrote on Twitter that they were working with various law enforcement agencies.</p>

"Orbit Chain Loses $81M in Cross-Chain Bridge Exploit"

Orbit Bridge hack

Orbit Bridge hacked for $81&nbsp;million

Someone had a not so fun end to the year when they fell victim to a phishing attack and had around 275,700&nbsp;LINK drained from their crypto wallet. Those tokens are priced at around $4.4&nbsp;million.<p>The attack was perpetrated by the Pink Drainer group, which had recently compromised the Twitter account of Compound Finance to try to lure its more than 250,000 followers into authorizing the malicious drainer. It's not clear if that's how this wallet was drained, however, as Pink Drainer uses numerous strategies to attract victims.</p>

Wallet gets phished for $4.4&nbsp;million

$TEL, the token associated with the Telcoin remittances project, plunged 40% as an exploiter was able to steal around $1.25&nbsp;million from the project. The company later disclosed that the issue had to do with how the project had been implemented on the Polygon network. The app was taken offline as the company investigated the hack.<p>Telcoin later announced that they "plan[ned] to restore all wallets to their previous balances", though did not say whether or how they would be making up the $1.25&nbsp;million deficit.</p><p>Telcoin had been <button class="define-target" id="audit">audited</button> by CertiK, though CertiK tweeted to say that "this <button class="define-target" id="smart-contract">contract</button> was not in the scope of the audit conducted by CertiK".</p>

Telcoin exploit

Telcoin exploited for $1.25&nbsp;million

An attacker successfully <button class="define-target" id="oracle-manipulation">manipulated an oracle</button> to drain around 10% of the <button class="define-target" id="liquidity-pool">liquidity pool</button> for the Levana Protocol, an Osmosis-based perpetual futures project. This amounted to $1.146&nbsp;million.<p>The attack was unusual in that it lasted almost two weeks, going unnoticed because it was draining pools slowly enough that the Levana team assumed it was organic activity. However, when the network became congested, the attack suddenly became more profitable — and more noticeable.</p>

Levana Protocol exploit

Levana Protocol loses over $1.1&nbsp;million in slow motion

A new <button class="define-target" id="wallet-drainer">wallet drainer</button> tool has stolen $58.98&nbsp;million in cryptocurrency assets from more than 63,000 victims in the past nine months. People using the drainer software have pulled in victims by running ads on Twitter and through Google ads, employing various tricks to thwart ad reviewers trying to thwart malicious ads on their platforms.

MS drainer

New wallet drainer steals almost $60&nbsp;million in 9&nbsp;months

The Aurory gaming platform uses a <button class="define-target" id="bridge">bridge</button> called SyncSpace to move assets between the blockchain and the game's off-chain network. On December 17, the bridge was targeted on Arbitrum's Camelot <button class="define-target" id="dex">DEX</button>, and an attacker successfully siphoned around 600,000 $AURY tokens from the <button class="define-target" id="liquidity-pool">liquidity pool</button>. As a result, the pool went from around $1.5&nbsp;million in liquidity to around $312,000, and the price of the $AURY token dropped 11% as the attacker sold it off in bulk.<p>The Aurory team posted on Twitter to acknowledge the hack, writing that they'd disabled SyncSpace as they investigated. They also wrote that SyncSpace had been <button class="define-target" id="audit">audited</button> months ago, but that the audit had failed to detect the vulnerability.</p>

"Aurory’s USDC pool drained on Arbitrum’s DEX Camelot"

Aurory bridge hack

Aurory bridge hacked for over $1&nbsp;million

Attackers exploited old <button class="define-target" id="smart-contract">smart contracts</button> from the NFT Trader peer-to-peer <button class="define-target" id="nft">NFT</button> trading application to steal pricey NFTs, including at least 37 Bored Apes, 13 Mutant Apes, and NFTs from the VeeFriends and World of Women collections. Some ETH and APE tokens were also stolen. Altogether, the stolen NFTs are priced at around $3&nbsp;million, though the hacker may not be able to liquidate them for that ammount.<p>One attacker claimed in on-chain messages that the original attack had been perpetrated by someone else, but that they were one of the many copycat attackers, describing themselves as someone who had "[come] here to pick up residual garbage". They requested victims send <i>additional</i> ETH to get their NFTs back. "If you want the monkey nft back, then you need to pay me a bouty, which is what I deserve", they wrote, asking for NFT holders to send them 10% of the Ape floor price.</p><p>Meanwhile, NFT holders were urged to revoke access to NFT Trader, since the platform seemed aware of the attack but unable to stop it. NFT Trader was ultimately able to thwart the attacker to stem additional bleeding, likely thanks to help from community members who pointed out a way the contract could be shut down.</p><p>Later, the "residual garbage" attacker returned 36&nbsp;Bored Apes and 18&nbsp;Mutant Apes after a Yuga Labs co-founder paid the 120&nbsp;ETH (~$260,000) ransom.</p>

"NFT Trader hacked, millions of dollars in NFT stolen"

Event	Date	Amount More info
Harmony infinite mint bug	January 15, 2024	$2,200,000
dogwifhat slippage	January 10, 2024	$5,700,000
Euler Finance private key loss	January 10, 2024	$3,800,000
"Undead Apes" rug pull	January 8, 2024	$128,000
Narwhal exit scam	January 7, 2024	$1,500,000
MangoFarmSOL rug pull	January 7, 2024	$2,000,000
CoinsPaid hack #2	January 6, 2024	$7,500,000
xKingdom rug pull	January 6, 2024	$1,250,000
Gamma Strategies exploit	January 4, 2024	$6,177,474
Bill Lou scammed	January 2, 2024	$125,000
Radiant Capital hack	January 2, 2024	$4,500,000
Orbit Bridge hack	December 31, 2023	$81,000,000
Wallet gets phished for $4.4 million	December 28, 2023	$4,400,000
Telcoin exploit	December 26, 2023	$1,250,000
Levana Protocol exploit	December 26, 2023	$1,146,000
MS drainer	December 21, 2023	$58,980,000
Aurory bridge hack	December 17, 2023	$1,188,000
NFT Trader hack	December 16, 2023	$3,000,000