Web3 is Going Just Great

April 1, 2021

FTX loses $800 million to MobileCoin market manipulation

At some point in April 2021, a trader on the FTX cryptocurrency exchange successfully exploited the firm for around $800 million. They were able to take positions in relatively illiquid crypto tokens, including MobileCoin and BTMX, then manipulate the token prices to appear much higher than their true market value (for example, MobileCoin spiked to $70 a token, rather than around $6). Using these falsely high-valued tokens as collateral, the trader was able to borrow around $800 million in more liquid tokens, abandoning the relatively valueless collateral on the exchange.

During the October 2023 criminal trial of FTX founder and CEO Sam Bankman-Fried, he gave more detail on how the exploit took place, and admitted that he personally had disabled FTX's automatic liquidation systems for this account. Though he intended to closely monitor the account to prevent any losses to FTX, he said that it was actually his actions that allowed the trader to drain such a massive quantity of assets from the exchange.

Prosecutors alleged that Bankman-Fried later had his cryptocurrency trading firm, Alameda Research, shoulder the loss, saying that he'd hoped it would be less visible on Alameda's balance sheets than on FTX's.

"The FTX trial, day fourteen: Same events, new stories", Newsletter by Molly White

March 19, 2021

Creators of "Turtledex", a project offering decentralized storage, make off with $2.5 million

(attribution)

24 hours after pre-sale, the team behind Turtledex drained $2.5 million from the liquidity pool and disappeared. Turtledex's smart contract had been audited shortly before the sale, with no major issues found, leading some to question the point of such audits.

"Binance Smart Chain's TurtleDex rug-pulls shortly after launch", Cointelegraph
"Another Binance Smart Chain Project Turtledex Rug Pulls With Tokens Worth $2.5M Confirmed Stolen", Bitcoin.com

March 14, 2021

Social token platform Roll hacked for $5.7 million

(attribution)

Private keys for hot wallets on the Roll network were compromised, allowing the theft of around $5.7 million from various "social tokens". "Friends With Benefits", an a16z-backed DAO with an associated token that allows those who are approved by the DAO and can afford the ~$8,000 entrance fee access to exclusive parties, was one of the tokens affected, and it tanked in value by about 96%. Roll apologized and announced a fund to help those affected, though the $500,000 fund was only a small fraction of the money lost.

"Social Money Platform Roll Hacked For $5.7M as Social Tokens Dump", CryptoPotato
"Roll still doesn't know how its hot wallet was hacked", TechCrunch
"Social Tokens Crash After Reported Hack at Roll", Coindesk

March 11, 2021

A headline-making $69 million NFT sale looks an awful lot like a publicity stunt

"Everydays — The First 5000 Days" by Beeple (attribution)

Vignesh Sundaresan's $69 million purchase of an NFT by artist Beeple made headlines. However, Amy Castor outlined a few days later that Sundaresan is a business partner of Beeple's, and that Beeple himself owns 2% of the B20 tokens created by Sundaresan's cryptocurrency investment firm. She speculates that money may not have exchanged hands at all, but that Sundaresan and Beeple orchestrated the purchase to artificially inflate the value of the work, increase Beeple's popularity, and draw attention to Sundaresan and his company.

"Metakovan, the mystery Beeple art buyer, and his NFT/DeFi scheme", Amy Castor
"JPG File Sells for $69 Million, as 'NFT Mania' Gathers Pace", The New York Times

March 9, 2021

Indie Developer sells commissioned pixel art as NFTs without permission from original artists

A pixel art abstract blue and white painting, with a pixel frame

TCD #71 --- Rise --- by Kyle Pulver (attribution)

Jason Rohrer, developer of the 2014 indie game The Castle Doctrine announced his plan to auction 155 of the digital paintings that he had commissioned for the game as NFTs on the OpenSea platform, without ever requesting permission from the original artists or informing them of his plan at all. In an email, Rohrer told Kotaku that he hadn't asked for permission from the artists to sell the works as NFTs "mostly because having email conversations with 50+ people would exceed my bandwidth as a solo creator." At least three artists asked for their work to be removed from the collection.

March 9, 2021

An NFT artist changes all images in their collection to photos of rugs to make a point about the value of NFTs

An OpenSea screenshot showing that all NFTs show photos of rugs

NFTs after the "rug pull" (attribution)

NFT artist "neitherconfirm" created a collection of 26 NFTs of stained glass-style computer-generated art. After release, they changed the art for each NFT to a picture of a rug, an apparent reference to "rug pulls". The artist wrote on Twitter, "Nobody got hurt. It is pretty easy to change the jpg, even if it does not belong to me or it is on auction. I am the artist, my decision, right? A thread from somebody making his living with art irl about the value of NFTs... All discussions about the value of NFTs are meaningless as long as the token is not inseparable from the artwork itself... What is the meaning of creating an unforgeable token on a highly secured network if somebody can alter, relink or destroy your possession? As long as the value of your artwork is reliable on a central service you do not own anything."

March 9, 2021

Hackers take $3.8 million from DODO

(attribution)

DeFi project DODO was relieved of $3.8 million after hackers exploited a bug in their v2 Crowdpools smart contracts. The exchange later recovered $1.89 million of these funds.

"Decentralized exchange DODO recovers some funds after attackers exploit bug for $3.8M", The Block
"DODO DEX Drained of $3.8M in DeFi Exploit", Coindesk
"DeFi Protocol Dodo Hacked for $3.8 Million", Decrypt

March 5, 2021

An attacker steals $3 million from the PAID Network

(attribution)

A contract exploit allowed a hacker to mint almost 60 million PAID tokens (priced at around $160 million based on the value before the attack) on the PAID Network. The hacker then made off with about $3 million in Ethereum from their efforts. The attack caused the PAID token to crash about 88% in value over the course of a day, from around $2.86 to $0.32.

"Crypto project PAID exploited, attacker gains over 2,000 ETH after minting nearly $160M in tokens", The Block
"PAID Network exploiter nets $3 million in infinite mint attack", Cointelegraph

March 4, 2021

Meerkat DeFi team briefly rug-pulls $31 million before returning the funds with an odd explanation

The team behind the Meerkat DeFi protocol claimed they had been victims of a hack, but subsequently disappeared from the web after the equivalent of $31 million in Binance Coin (BNB) and BUSD was pulled from the project. Two days later, a developer for the project wrote that the project had been a "test [of] user greed and subjectivity", and aimed to "[help] users realize the potential danger in smart contracts [and] the subjectivity in the audit processes of audit companies." The developer wrote that all victims would be refunded. Some believed that the bizarre "experiment" explanation was to cover that Binance had stepped in to address the scam.

"Binance Smart Chain 'copykat' project loses $31 million in possible rugpull", Cointelegraph
"Dev says $31 million Meerkat Finance exploit was a 'test'; will return funds", Cointelegraph

February 13, 2021

$37.5 million stolen from C.R.E.A.M. lending platform

(attribution)

A hacker was able to code a smart contract that tricked C.R.E.A.M. into believing it was from a trusted source. They were then able to make off with $37.5 million worth of Ethereum and stablecoins in what was only the first of several major exploits of the platform in 2021.

"Alpha Homora exploited for $37.5M", The Block
"DeFi Protocols Cream Finance, Alpha Exploited in Flash Loan Attack; $37.5M Lost", Coindesk

February 4, 2021

Yearn Finance loses $11 million to a hack

(attribution)

An exploit in Yearn Finance's yDAI vault resulted in an $11 million loss to the platform, though "only" $2.8 million of this went to the hacker.

February 3, 2021

Tether pays $18.5 million in penalties; NY Attorney General alleges they don't have the cash reserves they claim

(attribution)

The stablecoin Tether swears up and down that it's fully backed by actual currency, but the New York Attorney General doesn't agree. Tether paid $18.5 million in penalties, was banned from trading in New York, and agreed to submit transparency reports for two years in exchange for ending the long-running legal dispute.

"Tether, Bitfinex to pay $18.5M to NYAG, cease trading in New York", Amy Castor
"The curious case of Tether: a complete timeline of events", Amy Castor
"Cryptocurrency firms Tether and Bitfinex agree to pay $18.5 million fine to end New York probe ", CNBC
Press release from the New York Attorney General

January 28, 2021

PopcornSwap rug pulls

PopcornSwap launched on BNB Chain and then immediately drained its liquidity pool, making off with tokens priced at around $2 million.

Binance stated that they had been able to freeze users' assets on the BNB Chain partway through the incident. However, as of June 2023, Binance had not taken any steps to return the frozen funds to their original owners.

"What Are Liquidity Siphon Rugpulls on BNB Chain?", BSC News
"Binance faces criticism over handling of rug pull incident and frozen funds", The Block

January 19, 2021

Saddle Finance exploited within hours of launch

(attribution)

The Saddle Finance defi project, a fork of the Curve Finance project, launched on January 20. It promised it would "eliminate slippage".

The project was exploited only hours later, by attackers who stole more than 7.9 BTC (~$275,000) by taking advantage of high slippage on the platform.

"Saddle Finance", Rekt