Successful exploit of the CreatureToadz NFT project briefly nets a poorly-disguised hacker 88 ETH (almost $350,000)
A 17-year-old hacker was able to use a phishing webhook to make himself an admin in the CreatureToadz Discord server. Users who minted NFTs unknowingly sent cash to him, netting him a total of around 88 ETH (almost $350,000). However, after the hacker's real identity was uncovered shortly after the attack, the hacker returned the funds, claiming he'd intended to return it all along.
Hacker steals $16 million from Indexed Finance
A hacker drained $16 million from Indexed Finance, a defi protocol built on the Ethereum blockchain. The stolen funds represented nearly half of the total value locked on the platform. The hacker was later revealed to allegedly be an 18-year-old Canadian named Andy Medjedovic, who continued to refuse to return the funds even when his identity was revealed. The hacker argues that he simply took advantage of an arbitrage opportunity, and swore to "fight to the death" in court over his right to keep the money. However, the hacker never showed up to a December court appearance, and a warrant was issued for his arrest.
Four NFT projects on the Solana blockchain rug-pull in one day
Developers behind Solana Towers, an NFT project allowing investors to buy rooms in a metaverse virtual condo as NFTs, disappeared with around $280,000 a day after the project's launch. It was only one of the projects to do so that day, joining the developers behind three other Solana NFT projects: "Interstellar Bots", "Cheesy Dizzy", and "Technidroids".
The creator of the "Evolved Apes" NFT project makes off with $2.7 million a week after launch
A week after the launch of the "Evolved Apes" NFT project, which consisted of 10,000 NFTs and a promised fighting game, the anonymous developer behind the project disappeared after pulling the equivalent of $2.7 million out of the project's funds.
Baller Ape Club NFT developers rug pull for $2.6 million
A blatant clone of the extremely popular Bored Ape Yacht Club project, called "Baller Ape Club" and on the Solana blockchain, went live after much anticipation. Shortly afterwards, its creators made off with $2.6 million and deleted their websites and social media. The same group had pulled off one rug pull already, stealing around $150,000, and later went on to do a third rug pull in January 2022.
Founder of DeFi platform Compound threatens users who received mistaken payments with the IRS
Robert Leshner, the founder of Compound Labs, took an unusual approach when trying to recoup funds that were mistakenly distributed through a $160 million bug in the protocol. He tweeted, "Please return [the funds]. Keep 10% as a white-hat. Otherwise, it's being reported as income to the IRS". The threats were not received particularly well, with some questioning what assumptions Leshner was making about his typical user's tax status, and Leshner subsequently apologized for his "bone-headed" tweet.
An NFT project developer steals $138,000, sending images of random emojis to buyers
NFT collectors eagerly bought thousands of presales of an NFT project called "Iconics" after viewing sample artwork from a supposedly 17-year-old 3D artist. When they viewed their NFTs, instead of the 3D busts they had expected, they were brought to images of random collections of emojis. It was later discovered that the artwork had been stolen from an artist unaffiliated with the NFT project.
German government's blockchain-based ID wallet removed from app stores shortly after launch due to major issues
Shortly before the federal election, the German government launched the app "ID Wallet". It was supposed to store driver's licenses and other identification documents, and allow them to be shared with authorized parties (like the police, or during hotel check-ins). Because the distributed ledger back-end met neither basic EU security standards, nor handled more than a few thousand users (in total, not per second), the launch failed and private data stored in the app would have been exposed to identity theft. FOIA requests revealed that the project developers had known about the shortcomings of their design months in advance. The German Federal Office for Information Security wrote in a report, "[the use of the blockchain-based solution] significantly increases the complexity and, as a result, the fundamental susceptibility to security gaps in the entire system if the benefits are unclear".
- "ID Wallet: The German government had long known about IT security vulnerabilities", Market Research Telecast
- "Konzeptionell kaputt und ein riesiger Rückschritt", Netzpolitik.org
Vee Finance platform emptied of $35 million a week after its launch
The Vee Finance decentralized finance platform was hacked for $35 million worth of Ethereum and Bitcoin. The platform suspended trading after the hack was discovered, and also tried to tempt the hackers with promises of a bug bounty if they'd just be so kind as to return the funds. The platform had only launched a week earlier, though boasted of having $300 million worth of assets locked on their exchange.
pNetwork loses $12 million to a bug
Supply chain attack drains $3 million from SushiSwap
SushiSwap's token platform, Miso, was hit with a supply chain attack that landed the attacker more than $3 million worth of Ethereum. Malicious code was injected into the platform's frontend by a contractor who submitted a pull request. The attacker was able to target a car-themed NFT auction called "Jay Pegs Auto Mart". However, the team discovered the identity of the attacker and the funds were returned after some legal threats.
Head of Product for major NFT platform, OpenSea, is asked to resign following allegations of NFT insider trading
A Twitter sleuth discovers that OpenSea's Head of Product, Nate Chastain, had apparently been engaging in a form of insider trading by buying NFTs that he knew would later be featured on the front page of OpenSea, then selling them once their value increased from the spotlight. The Twitter user identified a chain of transactions show Chastain laundering the transactions through several anonymous accounts. OpenSea posted a statement confirming the shady trades had taken place, and that they had requested and received the employee's resignation, though they didn't specifically name Chastain as the culprit. Chastain's Twitter profile was updated shortly after, identifying him as a former OpenSea employee. OpenSea announced the next day that they had implemented policies preventing employees from trading on confidential information, which I guess they just hadn't bothered to think about previously.
GTV Media Group, a media company operated by Steve Bannon and Guo Wengui, pay $539 million settlement over ICO
The SEC filed charges against GTV Media Group and related entities, alleging they engaged in an unregistered ICO when they offered investors the opportunity to buy "G-Coins" (also called "G-Dollars"). GTV immediately settled with the SEC, agreeing to pay over $539 million.
GTV Media Group is a media company co-founded by Steve Bannon and Guo Wengui, both figures in the American far right who have close ties to Donald Trump.
- "SEC Charges Three Media Companies with Illegal Offerings of Stock and Digital Assets", U.S. Securities and Exchange Commission
Fake press release dupes media outlets into reporting that Walmart will begin accepting Litecoin
A press release distributed via GlobeNewswire claimed Walmart was announcing a partnership with Litecoin to begin accepting the cryptocurrency as a payment method. The value of Litecoin spiked before tumbling after Walmart said the announcement was fake.
SEC charges Rivetz Corp. and related entities for $18 million ICO
The SEC charged Rivetz Corp. and related entities with running an illegal ICO when they launched their "RvT tokens". They raised $18 million through the ICO, which they never registered with the SEC, to raise funds for the Rivetz blockchain security company. The funds, which were raised in ETH, were used to give the company's founder a $1 million bonus, plus a $2.5 million loan which he used to "purchase a house in the Cayman Islands that he then leased back to Rivetz Int'l."
- "SEC Charges Issuers and CEO for $18 Million Illegal Securities Offering", U.S. Securities and Exchange Commission
El Salvador adopts Bitcoin as legal tender
Nayib Bukele unexpectedly announced that El Salvador would be adopting Bitcoin as legal tender, and the policy went into effect on September 7, 2021. With the benefit of hindsight, we can see that the decision came near the very top of the Bitcoin prices. Those who put money into Bitcoin at Bukele's urging have lost quite a lot of money.
So has El Salvador itself, assuming Bukele is telling the truth about his many claimed Bitcoin purchases. As of December 2022, Nayib Bukele has lost more than $67 million on those investments.
C.R.E.A.M. Finance exploited again, this time for $25 to $30 million
A vulnerability in C.R.E.A.M. Finance allowed a re-entrancy attack to steal somewhere between $25 and $30 million from C.R.E.A.M. finance in its second multimillion dollar hack of the year.
xToken loses another $4.5 million in second hack of the year
A vulnerability in xToken's xSNX product allowed hackers to use flash loans to empty $4.5 million from xToken. This hack followed an even larger hack in May, where the platform was exploited for around $25 million.
Scammers posing as Bored Ape Yacht Club founders scam NFT collector Sohrob Farudi out of $800,000
The day after Nicholas lost almost $500,000 to NFT scammers, another collector was targeted for an even larger sum. "I've never felt more dumb, helpless, embarrassed or just plain sad in my entire life", Farudi wrote on Twitter. The scammers, who pretended to be the founders of the popular Bored Ape NFT collection, had tricked him into exposing his private key QR code to them in another Discord/OpenSea scam.
Scammers posing as OpenSea support staff steal $480,000 from NFT collector Jeff Nicholas
After asking for help in the OpenSea Discord channel, Nicholas was successfully scammed by individuals posing as customer support. After convincing the investor to share his screen, allowing scammers to view his private key, they transferred all of his NFTs, worth almost $500,000, from his wallet in transactions that can't be reversed. Earlier that year, Nicholas had appeared as a guest on a podcast episode titled "How NFTs Will Change Everything".
- "The NFT scammers are here", The Verge
Liquid Global cryptocurrency exchange hacked for $90 million
Japanese cryptocurrency exchange Liquid Global suffered a hack that saw $90 million in various assets stolen. The exchange stated that the attack had targeted the company's MPC wallet.
A week after the hack, FTX extended a $120 million loan to the platform. In April 2022, FTX formally acquired Liquid for an undisclosed amount.
DAO Maker project exploited for more than $7.3 million
The DAO Maker project (not to be confused with the well-known MakerDAO) is a launchpad that claims to be "building the future of venture capital". Its website boasts that users who stake their $DAO can "earn up to 70% APY". The project suffered an exploit on June 3 in which attackers stole 7,376,245 USDC, a US dollar-pegged stablecoin. Although the project had been audited by three different auditing companies, hackers were able to exploit an issue in the claim portal for some tokens. According to the DAO Maker team, 5,521 users were affected, and lost an average of $1,250 each. Attackers immediately moved some of the funds to the Tornado Cash cryptocurrency tumbler, while some remained dormant for months before being moved.
$611 million is stolen from Poly Network in one of the largest cryptocurrency heists to date
Hackers stole approximately $611 million from the decentralized finance platform Poly Network in the largest cryptocurrency theft against a single platform to date. In a bizarre twist, the hacker returned the funds, and Poly Network offered them a position as a chief security advisor (though it is not clear if they accepted).
"Women-led" NFT project, "Fame Lady Squad", turns out to be a bunch of dudes
The "Fame Lady Squad" NFT project touted itself as a woman-designed and -developed project that would give back to women in the space, drawing support from high-profile individuals like Gary Vaynerchuk, and ultimately around $1.5 million in investments. Problem is, the three women who were supposedly running the project were a group of Russian men, accused by one of the individuals who uncovered the lie of trying to profit off American social causes. The group had a history of creating NFT projects based on false stories. One of their other projects, "Cyber City Girls Club", was intended to campaign to stop hate against Asians, and also originally purported to be run only by women (it wasn't).
Poloniex settles with the SEC for more than $10.3 million
Poloniex, a cryptocurrency exchange, agreed to pay more than $10.3 million in a settlement with the SEC. The SEC had alleged that Poloniex had flouted securities laws from 2017 thorugh 2019 by operating an unregistered trading platform. In the settlement, Poloniex neither admitted nor denied the charges.
The US-based Poloniex was acquired in 2018 by Circle, then in late 2019 by an investment group that included Justin Sun. Sun moved Poloniex to the Seychelles and closed U.S. operations upon acquiring the platform.
Blockchain Credit Partners forfeits over $12.8 million in SEC agreement
The SEC charged two individuals with selling more than $30 million in unregistered securities in what they described as a defi project that bought "real world" assets like car loans to generate income for investments they promised investors would generate more than 6% interest. Although the company was not able to operate as they'd promised, due to crypto's price volatility, the company lied to investors that all was hunky-dory.
The respondents agreed to a $12.8 million forfeiture of ill-gotten profits, plus a combined $250,000 penalty. The case marked a first from the SEC in the decentralized finance space.
DeviantArt releases software to detect infringement of artwork on NFT marketplaces... because the NFT marketplaces won't
DeviantArt releases software to automatically scan the NFT platform OpenSea for NFTs that use stolen artwork from DeviantArt. While it's awesome that DeviantArt created this tool to help the artists on their platform, it underscores the hands-off, look-the-other-way approach OpenSea has taken to the rampant art theft on their platform. Even reports of blatant copies of artwork have been rejected with no action, and artists are forced to report each infringement of their work individually even if there are many.
Uulala and related individuals settle with SEC for a total of $543,000 in fines
The company Uulala, which aimed to provide underbanked individuals with opportunities to build credit, settled with the SEC over charges that they ran an unregistered ICO that raised $9 million. Although they claimed to be using a "proprietary micro-credit algorithm" and proprietary database technology, the SEC said their algorithm was still under development and that they were using database technology belonging to another company. As a part of the settlement, Uulala disabled all $UULA tokens and asked crypto exchanges to disallow trading.
Flash loan exploit empties $25 million from Popsicle Finance
Popsicle Finance, a DeFi platform, lost $25 million to a bug exploited with flash loans. The organization later reimbursed users who lost money to the exploit.
Russian Ponzi scheme collapses after defrauding investors of around $95 million
Finiko, a Russian operation that turned out to be a Ponzi scheme, collapsed in July 2021 after defrauding approximately $95 million from people. Investors, facing difficult economic conditions in Russia, were promised they could see returns of up to 30% a month.
An attacker steals coins by giving out coins of their own
An attacker giving out free UniH tokens was able to exploit a bug in a non-standard token contract and steal RUNE tokens from unsuspecting victims. By baiting people into selling their new UniH tokens, the attacker was able to execute malicious code that transferred any RUNE tokens also in their wallet. This was the fourth exploit pertaining to the Thorchain platform in the month of July.
Norton Antivirus now sneakily installs a crypto miner on your computer so you can mine crypto (and give some to them)
Norton, the makers of the popular Norton Antivirus software, started installing "Norton Crypto" on customers' machines when they install the popular Norton 360 antivirus and malware protection software. It mines Ethereum, skimming 15% for Norton of course. They don't seem to mention that the energy costs incurred by crypto mining on a personal machine are likely to exceed any actual mining proceeds.
Coinbase said its USD Coin would be fully backed 1-1 with USD. It isn't.
Coinbase's USD Coin claimed that there was $1 "in a bank account" to back it, meaning that if everyone hypothetically tried to redeem their USDC at once at any given time, it would be possible. A July disclosure showed that this wasn't true, and that the coin was actually backed by commercial paper, corporate bonds, and other assets. Bloomberg speculated that the FTC might investigate the claim as a possible "unfair or deceptive act or practice".
StableMagnet makes off with $27 million in rug pull
StableMagnet creators rugpulled about $27 million from users by swapping out linked library code. Users who had StableMagnet linked to their cryptocurrency wallets saw their wallets drained.
A not-so-stable stablecoin, titan, comes crashing down
The cryptocurrency "titan" dropped from $65 to $0.000000024 within a few hours, despite being a stablecoin that is supposed to be much less volatile than most cryptocurrencies. As the price began to drop, the smart contract encountered a bug that prevented investors from selling their holdings. Among those burned by the coin's crash was billionaire investor Mark Cuban, who had blogged about the token only days prior.
Hacker nets $6.3 million in Belt Finance exploit
Belt Finance fell victim to a flash loan attack which netted an attacker $6.3 million. This was yet another exploit targeting a protocol built on the Binance Smart Chain protocol, following other attacks over the previous five months on C.R.E.A.M. Finance, bEarn, Bogged Finance, Uranium Finance, Meerkat Finance, SafeMoon, Spartan Protocol, BurgerSwap, and PancakeBunny.
- "Belt Finance loses millions in latest BSC-based DeFi exploit", Cointelegraph
- "Belt", Rekt
SEC begins case against those involved in alleged $2 billion BitConnect fraud
The SEC filed an action against five individuals that they alleged promoted unregistered securities in a $2 billion investment scheme, which they described as a "lending program". In September, the SEC also charged BitConnect's founder, Satish Kumbhani, for his role in the scheme, as well as an additional promoter.
- " SEC Charges U.S. Promoters of $2 Billion Global Crypto Lending Securities Offering", U.S. Securities and Exchange Commission
- SEC v. BitConnect
"Trivial" bug costs BurgerSwap $7.2 million
A missing line of code made it "trivally" easy for an attacker to use a flash loan attack to pull $7.2 million from the DeFi platform BurgerSwap. BurgerSwap said it would "strive to cover all [users'] loss".
Attackers drain $3 million from BOG liquidity pool
Attackers exploited a flaw in the smart contract of Bogged Finance's BOG token to drain half the liquidity pool, equivalent about $3 million. This resulted in the BOG token tanking in value from about $1.80 to $0.0003.
Rumors swirl around what actually happened with DeFi100: a rug pull, or a simple website defacement?
DeFi100, a Binance-based DeFi protocol, suddenly replaced its website with a statement: "We scammed you guys and you can't do shit about it". One crypto analyst estimated a scam would've netted the team $32 million. However, the developers subsequently denied the scam and claimed the website had been hacked, restoring it soon after. Although the developers maintain they never stole any money, rumors around what actually happened sank the project.
$45 million stolen from PancakeBunny Finance
A hacker used flash loans to manipulate the price of other token pools, to then exploit a bug in PancakeBunny logic that calculates how many tokens should be minted. They were able to mint and then sell 7 million tokens, making off with $45 million and tanking the price of BUNNY tokens from $146 to $0.90. PancakeBunny tweeted shortly after the attack that they would be "working on a reimbursement plan" for those affected.
FinNexus "hacked" for $7.6 million in likely inside job
A decentralized finance project called FinNexus was reportedly hacked for $7.6 million, in what was widely speculated to actually be a rug pull by the project's developers.
The theft appeared to have been enabled by someone who had access to the project's admin key, and was able to change the token owner to an address where they then minted and withdrew tokens, amounting to a $7.6 million theft.
Hacker drains $10.85 million from bEarn Fi
An attacker pulled $10.85 million in funds out of one of bEarn Fi's vaults by exploiting a bug that allowed them to withdraw more funds than they deposited. bEarn promised to compensate affected users with 105% of the amount they lost.
$24.5 million emptied from xToken platform
A flash loan attack allowed hackers to exploit two vulnerabilities in the xToken DeFi platform and steal $24.5 million. This was the first of two large-scale hacks of the platform this year.
Rari Capital exploited for $15 million
An attacker exploited a Rari Capital ETH pool, stealing ETH worth around $15 million. The theft caused the price of Rari's governance token to plummet by around 50%.
Value DeFi hacked twice in one week, three times in six months
After a $10 million hack just two days prior, Value DeFi had another $11 million stolen after attackers found and exploited a different bug in their smart contract.
Value DeFi hacked for the second time in six months
Attackers exploited a bug in Value DeFi's smart contract to drain $10 million out of the platform, in a second attack in six months. In November 2020, the platform had lost $7 million to a flash loan attack, after bragging about their "flash loan attack protection". The group was also discovered to be using a paid actress to pretend to be one of their co-founders.
A bug in the Spartan Protocol platform allows an attacker to steal around $30 million
A flawed calculation pertaining to the liquidity pool of Spartan Protocol allowed an attacker to drain $30 million from the project.
- "Spartan Protocol exploit results in loss of $30M", Cointelegraph
An attempt to incorporate NFTs throws a wrench into a $40 million domain name auction
Frank Schilling, founder of the Uni Naming & Registry (UNR) held an auction for 23 TLDs (the bit at the end of the domain, like .com or .org). These included
.link, .help, .game, and even .christmas. The April auction grossed more than $40 million, but as of mid-December the transactions had not been completed. This is because UNR attempted to add some marketing flair to the auction by including NFTs for each of the TLDs, to go to the auction winners. ICANN, the group responsible for much of the domain world, objected to and withheld consent for the transactions, writing "we sought to understand the impact of the transactions on the Domain Name System ('DNS'), including how Non-Fungible Tokens (NFTs) created on the Ethereum Name Service (ENS) were being used, and were involved in the transactions. ICANN repeatedly asked UNR for documentation or other information related to NFTs in the hopes that UNR would provide fulsome and complete responses."- NFTs trip up Uniregistry's top level domain auctions, Domain Name Wire
Uranium Finance is drained of $50 million in hack
A bug in Uranium Finance, a DeFi exchange based on Binance Smart Chain, allowed an attacker to drain the liquidity pools for multiple token pairs. Uranium had just commissioned an audit which uncovered the bug, but the attack occured two hours before the patch went live. An apparent member of Uranium's development team wrote that they believed the attack had been the result of leaked information.