Vulcan Forged users lose a collective $135 million in hack
Stolen private keys from the blockchain gaming platform Vulcan Forged enabled attackers to siphon funds out of just shy of 100 user wallets. Rather than users managing their own private keys, this is done by the platform, suggesting the issue was not user error. The project says it plans to reimburse users.
The Seattle Kraken NHL team, whose home stadium is named the Climate Pledge Arena, raise eyebrows with an NFT release
The Seattle Kraken announced that they would be releasing a set of NFTs. Although several sports groups have released NFTs, people were particularly surprised to see it coming from a team that is known for its environmental advocacy. Though the NFT release will be on a proof-of-stake blockchain that claims to be net-zero emissions (Avalanche), many were up in arms about the team engaging in something that they see as antithetical to environmentalism.
Typing error costs NFT trader nearly $300,000
An NFT trader made a typing error when entering a listing price, accidentally listing his Bored Ape NFT for 0.75 ETH (about $3,000) instead of 75 ETH (about $300,000). The NFT was instantly bought by a bot account. The BBC writes, "In traditional banking transactions, such errors are usually reversed easily if the bank facilitating them is told about the mistake quickly. But in the unregulated crypto-trading market, there is usually no way to reverse such a sale."
Fable creator Peter Molyneux announces an NFT game where you run a company town
Peter Molyneux announced a new game, Legacy, a business management simulator (fun!) where you join by buying an NFT called "Land", and compete to increase your "LegacyCoin" bank account balance. The company in the game effectively is running a company town, a real-world model with a history that is far more fraught than Molyneux acknowledges in his Verge interview.
Cryptocurrency exchange Ascendex hacked for $77 million
Ascendex lost $77 million in a hack targeting hot wallets. The platform said it would reimburse customers for all of their lost funds.
McDonalds NFT project overshadowed by a possible link to a racial slur
McDonalds tried to make a splash with a McRib-themed NFT project, but that was quickly outshined by the discovery that an early transaction to the Ethereum address associated with the collection contained a racial slur.
Crowdfunding website Kickstarter announces it will abandon its current platform in favor of a blockchain implementation
Kickstarter announced they have decided to create a decentralized version of their platform, and to create it on the Celo blockchain. This was not entirely well-received, and some major users strongly opposed the idea. Per Gizmodo, "How this will actually work, beyond Kickstarter being able to yell 'blockchain' like a spell to summon investors or maybe getting a cut of every project that runs on the resulting protocol, is unclear."
A "decentralized exchange", dYdX, is taken down in an AWS outage
During a widespread AWS outage, supposedly-decentralized DeFi platform dYdX went down. dYdX is an Ethereum exchange that touts itself as the "world's leading decentralized exchange", and indeed it is estimated to be the fourth largest exchange. Whether it's decentralized or not, however, is much more in question following the outage. Other major platforms (that are more known to run on centralized infrastructure) such as Binance and Coinbase were also affected by the AWS blip.
Ubisoft announces it will be shoehorning NFTs into its Tom Clancy game
Ubisoft announced that it would be adding NFTs to its Tom Clancy's Ghost Recon Breakpoint title, allowing players to buy "Digits": artificially scarce in-game weapons, vehicles, and cosmetics. The announcement video on YouTube sported a 96% dislike ratio shortly after, with the top comment accusing Ubisoft of "milking the Ghost Recon franchise for literally every cent while putting in minimal effort into the actual game itself". Many Ubisoft developers were also caught off guard: some were worried they would be forced to include NFTs in other game titles they were working on, while others raised environmental concerns that come with Ethereum NFTs. The project had a very underwhelming reception — two weeks after its launch, they had sold only fifteen of the more than 2,000 NFTs, for a total of around $400.
- "Ubisoft's NFT Announcement Has Been Intensely Disliked", Kotaku
- "Gamer-hate: Ubisoft’s new NFT project video gets 96% dislike ratio", Cointelegraph
- "Ubisoft's first NFT plans make no sense", Ars Technica
- "Ubisoft Devs Don’t Understand Company’s NFT Push, Either", Kotaku
- "No One’s Buying Ubisoft’s Garbage Ghost Recon NFTs", Kotaku
8ight Finance completely drained after private key leak
A compromised private key allowed an attacker to remove all funds from 8ight Finance's treasury, amounting to about $1.75 million. The team admitted to sending the key through Facebook chat and Google Drive, writing, "This is our first project, so we must admit our opsec [operational security] was low."
WildWorks angers its fans by announcing it will be moving into crypto gaming
WildWorks, a game company with a reputation for eco-friendliness, angered many of its fans when it announced it would be reusing the technology and assets from its partially-finished title Feral for a new metaverse game called Cinder. Some fans were upset to hear that the developers were apparently leaving Feral unfinished; many were angry about the developers' choice to embrace NFTs and crypto gaming — particularly after the company itself had decried the technology's impact on the environment, but also because of concerns about the unethical nature of many projects in the web3 space. Attempts to reassure fans with the fact that they will be using the Solana proof-of-stake blockchain, and purchasing carbon offsets, apparently did little to mollify fans, some of whom began cancelling subscriptions.
WildWorks later split Cinder into a separate company, Cinder Studios. However, in early 2023, the studio shutdown, giving its employees no advance notice that they would soon be out of a job.
Coindesk writer Andrew Thurman says the quiet part out loud
Thurman began an article by writing, "Yes, it's a Ponzi scheme. But who cares? So are the dollars in your pocket." He was writing about OlympusDAO, a "decentralized finance (DeFi) protocol whose primary use case seems to be 'making people extremely angry.'"
Polygon loses $2 million to a vulnerability
Polygon lost a bit over $2 million after a hacker exploited a bug involving a lack of balance/allowance check in their MRC20 contract. Polygon had been in the process of releasing a patch for the vulnerability, which had been reported by a white-hat hacker, and released an emergency upgrade the following day. The silent, zero-warning hard fork raised some eyebrows, and Polygon didn't release details until several weeks later. Polygon ultimately paid about $3.5 million in bug bounties to two white-hat hackers who submitted reports, which was far less than the total value of Polygon's $MATIC tokens, all 9.2 billion of which (worth around $24 billion) could have been stolen by an attacker using this vulnerability.
Tether mints $3 billion in two weeks
Tether minted more than $3 billion in a two week span. This brings the total amount of USDT (which is pegged to the U.S. dollar) to 76 billion, and much of it was minted this year. If Tether actually had reserves to back this up, as they claim, they would be one of the largest banks. However, as the Financial Times reported, in March 2021 "the stablecoin that used to say it was 100 per cent backed by cash reserves is in fact... 2.9 per cent backed by cash reserves".
Hackers steal about $200 million from BitMart
BitMart, "the most trusted cryptocurrency trading platform", experienced a major breach in which attackers stole approximately $200 million of various cryptocurrencies. The CEO attributed the exploit to a stolen private key, and promised to compensate users who were impacted.
Wikipedia founder Jimmy Wales angers some in the Wikimedia community by announcing he will be auctioning off an NFT representing the first ever edit
Wales announced he would be auctioning an NFT of a website representing the first edit to Wikipedia. This was not taken well by some in the Wikimedia communities — some felt he was misusing Wikipedia to advertise a commercial opportunity for himself that benefits the Wikimedia movement in no way, others felt that NFTs and the artificial scarcity intrinsic to the idea are antithetical to the Wikimedia ideology. Wales is also auctioning off a strawberry-colored iMac (pictured) he used to work on the site, and most people seem to agree that is pretty cool. The NFT ultimately sold for $750,000; the iMac went for $187,500.
SEC charges individual with two fraudulent crypto schemes
The SEC charged Latvian citizen Ivars Auzins with investment schemes he created using fake names and businesses. He allegedly created a fraudulent ICO for a coin that would back "Denaro", what he said was a debit card-like cryptocurrency wallet, but which never actually existed nor had a partnership with a credit card issuer as he claimed. In his second scheme, Auzins allegedly offered unregistered securities of Innovamine, which promised to mine cryptocurrencies on behalf of investors and give them a payout. According to the SEC, Auzins misappropriated nearly all assets he raised through his frauds — at least $7 million.
- "SEC Charges Latvian Citizen With Digital Asset Fraud", U.S. Securities and Exchange Commission
CODEX, a decentralized publishing platform, aims to artificially constrain access to books
A platform called "CODEX" announced that they intend to "upgrade the digital book market industry to Web3". This, apparently, involves artificially limiting the number of copies of books that can be distributed, using technology that is definitely not just a worse version of DRM.
$120 million is stolen from BadgerDAO
A hacker was able to use a compromised Cloudflare API key to inject malicious code into the BadgerDAO platform via Cloudflare Workers. They then siphoned currency of various kinds, equivalent to approximately $120 million, out of user accounts over approximately two weeks before being discovered.
NFT collecter friesframe has a Bored Ape and several other valuable NFTs stolen
Although friesframe had transferred some of his valuable NFTs to cold storage (a crypto wallet not connected to the Internet), he had been waiting for gas fees to come down before transferring more. In that period, his hot wallet was hacked, and a Bored Ape NFT and several others were stolen.
$31 million stolen from MonoX in smart contract bug
A hacker stole $31 million from the liquidity pool provider MonoX by exploiting a bug in their smart contract software that allowed them to exchange a token for itself and artificially inflate the price. MonoX took the classic approach of those burned by crypto issues, and tried to get the cash back by... asking nicely.
A project called "Unvaxxed Sperm" combines COVID-19 misinformation and memecoins
Developers launched a memecoin called "Unvaxxed Sperm", hoping to make a buck while also recruiting for their anti-vaccine group. The name is based on the belief that in the future, sperm (and eggs) from unvaccinated individuals will have enormous monetary value, which is based on the false belief that COVID-19 vaccines render people infertile. The group also promised to make a "pureblood" version of Tinder for the unvaccinated, and create a DAO to allow investors to crowdsource decisions on which anti-vaccine groups and individuals are worthy of their donations.
Either a rugpull or massive communication failure ends in disaster for most holders of SnowdogDAO's token
SnowdogDAO creators say they didn't rugpull, but that the coin plummeting over 90% was a "game-theory experiment" that went wrong. The project was intended to only last for eight days, and when the developers began the planned buyback of SDOG tokens, value crashed. The developers never made it clear to the community that only 7% of tokens could be sold above market price before the buyback, and hundreds of people lost most of their funds. Three addresses made between $3.3 and $10 million from the buyback, and many believe they belong to people who are connected to the development team. In total, about $30 million was lost.
- "Avalanche’s first memecoin SDOG ends in a $30M possible rugpull", Cryptoslate
- "OlympusDAO Fork Snowdog Hit By 90% Crash", Crypto Briefing
Alleged serial scammer launches "MetaWorld" project for at least the third time
Dedric Reid has repeatedly stolen art and promotional material, passing off other projects' work as his own, to promote his "MetaWorld" project — a concept he's been promising (and fundraising for) in various forms since as early as 2016. He's recently relaunched it with a web3 spin, including metaverse ideas and NFTs into its newest form, but it appears to be as much vaporware as it was five years ago. Reid has raised at least $14,000 over the years for this idea which still has no tangible result, though Engadget believes the true amount scammed is probably higher.
SEC charges individual with two unregistered securities offerings related to crypto
The SEC filed charges against Ryan Ginster related to two online platforms that he ran, MyMicroProfits.com and Social Profitmatic. He promised investors what the SEC described as "astronomical" rates of return, which he claimed were achieved through various financial activities including cryptocurrency trading. According to the SEC, Ginster misappropriated at least $1 million of the $3.6 million in Bitcoin he raised, using it to pay for his own personal expenses.
- "SEC Charges Promoter with Conducting Cryptocurrency Investment Scams", U.S. Securities and Exchange Commission
Senate committee demands answers from stablecoins including Tether
The U.S. Senate Committee on Banking, Housing, and Urban sent letters to various stablecoin operators including Tether, Coinbase, and Binance, asking for more details on how the companies operate, and how they mint their currencies. In the letter, senators write, "stablecoins present investor protection risks and raise several market integrity concerns". Some worry that if Tether fails, it will collapse various cryptocurrencies and potentially disrupt traditional finance.
NFT creator makes more than $7.5 million from artwork he doesn't own
An art curator created NFTs from photographs of Stormtrooper helmet artwork, but failed to actually ask permission from the artists. The NFTs sold for a collective $7.5 million before various marketplaces removed them from trading. Several of the artists responsible for the works are reportedly considering legal action. The NFT creator, meanwhile, has posted a video of himself on social media "wearing a Stormtrooper helmet, shooting a gun in the air and bragging about making 'two mil on NFT[s]'".
Game developers are forced to recreate their entire game after a bug is discovered
Because Wolf Game put their entire source code into the blockchain, they were unable to patch an exploit once it was discovered. They had to completely recreate the game, reissuing all new tokens to players, because of the immutable nature of the blockchain. They've created a bug bounty program for any future bugs, though given their storage technique any patch would likely require a similarly extreme remedy.
A DAO raised more than $40 million to try to buy a copy of the United States Constitution, failed, and then stumbled chaotically to its end
ConstitutionDAO emerged out of a Twitter joke, but ultimately raised more than $40 million to bid on an auction for a rare first printing of the U.S. Constitution. After being outbid by a hedge fund CEO, the group refunded all donations. However, there was enormous infighting over things like the possible value of the governance token (named $PEOPLE), and enormous gas fees taking up much of the money that people were supposed to be refunded. Ultimately, the DAO closed down without a single vote being cast.
- "Crypto collective raises $40 million to buy rare copy of U.S. Constitution", Fortune
- "Crypto collective loses bid to buy rare copy of U.S. Constitution", Fortune
- "ConstitutionDAO Is Shutting Down After Unrelenting Chaos", Vice
- "'Buy the Constitution' Aftermath: Everyone Very Mad, Confused, Losing Lots of Money, Fighting, Crying, Etc.", Vice
Someone mints an NFT of 100 stolen furry profile pictures and sells it for $100,000
In an apparent "fuck you" to members of the furry community who have been critical of NFTs, and to those who have pointed out that you can right-click and save files that people are paying enormous amounts for pointers to, someone minted an NFT titled "Right Click Save This". It features an image of Pepe the Frog overlaid on a collage of 100 stolen furry Twitter profile photos. The NFT sold for around $100,000, though after mass DMCA requests it was delisted from the OpenSea and Foundation marketplaces. The creator later promised to pay any owner of an image used in the collage $5,000, but only if the owner minted a token of their artwork and sent it to the collage creator.
Chinese police bust Filecoin miner-related Ponzi scheme
Chinese police arrested 31 people for allegedly running a Ponzi scheme, in connection to sales of mining equipment for the filestorage crypto project Filecoin. The individuals were all associated with a Shanghai Filecoin mining equipment firm called IPFSUnion, although it's not clear if IPFSUnion was involved in or aware of the schemes or if their equipment was simply used by the outside scammers.
Filecoin mining became popular in China after Filecoin's 2018 initial coin offering, and Ponzi schemes and scams based around the token also emerged. Mostly, these involved selling poor equipment or soliciting investment in so-called mining operations that promised exaggerated returns.
A group pitches the idea of a "Cryptoland" crypto-themed private island with a video that is nearly indistinguishable from satire
Signs unfortunately point to this being an actual, real project rather than satire, but the video purporting to advertise it dunks on cryptobros harder than most satirists have managed to. A campy 3D-animated video with strong Fyre Festival vibes is complete with scenes of its cryptobro main character uncomfortably hitting on a female employee of "Cryptoland", and walking around with an anthropomorphized coin who is apparently named "Connie" (so like... con?), and performing in a terrible musical number. The project's founders say they've already spent more than a year and employed 30 digital artists to produce their 3D-animated pitch, but it doesn't appear that they've put the same effort into making their ideas a tangible reality. They own no land on which to have started construction on their various attractions, or to park the Lamborghinis they promise to provide. One thing they have done, though, is list parcels of land on this apparently as-yet-imaginary island in Fiji for sale — for the low, low price of 319 ETH (about $1.2 million).
Hacker steals around $55 million from bZx
An attacker fooled a developer of the bZx decentralized finance platform into opening a Word document with a malicious macro, which ran a script that gave the attackers access to the developer's crypto wallet private keys. They were able to gain access not only the developer's personal wallet keys, but to two keys to bZx wallets. The attacker made off with approximately $55 million. bZx subsequently tried to offer the attacker a bounty to return the funds, though they were not successful.
Media outlets are duped into believing that Kroger will begin accepting Bitcoin Cash
PR Newswire republished a fake press release which claimed that the Kroger supermarket chain would begin accepting "Bitcoin Cash" (not to be confused with Bitcoin) at its outlets. The fake press release was briefly successful in pumping the value of the currency before it was revealed to be a hoax.
Blockchain Global enters liquidation
Blockchain Global, the parent company of a cryptocurrency exchange called ACX.io, entered voluntary administration after its protracted collapse. Customers had been unable to access funds on the exchange since late 2019.
Creditor claims are likely to exceed $50 million. The operators of the company allegedly commingled customer, investor, and company funds, and used this pool of money on personal expenses and investments in other companies. The liquidator has recommended that the Australian Securities & Investments Commission (ASIC) investigate the company's directors, Sam Lee, Zijing "Ryan" Xu, and Liang "Allan" Guo.
Oracle manipulation attack against Vesper Finance nets hacker over $3 million
By manipulating the price of a low-liquidity, beta-stage stablecoin, an attacker was able to borrow all tokens in a Rari Fuse pool using the initial token as (inflated) collateral. They then swapped the tokens for Ethereum, and made off with more than $3 million.
BXH exchange exploited for $139 million
The decentralized exchange BXH was exploited for $139 million. BXH CEO Neo Wang attributed the exploit to a compromised administrator key, which he said suggested either a staff member's computer was breached, or a staff member themselves was behind the theft. BXH offered a reward to the hacker if they returned the funds, and offered a $1 million bounty to any person who could help retrieve the funds, but was ultimately not successful in having the money returned.
Creators of a Squid Game-themed token make off with more than $3 million
Creators of a Squid Game-themed token (not affiliated with, or authorized by, those behind the Netflix series) created a token which quickly skyrocketed in value and earned news coverage in outlets like the BBC. Not long after investors began to report they were unable to sell their tokens, creators drained $3.36 million out of the liquidity pool in an apparent rug pull.
NFT collector scammed out of almost $1 million
NFT collector Calvin Becerra fell for some social engineering on Discord: "Guys posing as buyers in Discord were helping me troubleshoot a problem we thought was happening... They walked me through language settings in my MetaMask and had me choose an option and took everything." The scammers obtained three of his "Bored Ape Yacht Club" NFTs (one pictured), which collectively valued around $1 million. Becerra successfully lobbied OpenSea, Rarible, and NFT Trader to block sales of the stolen NFTs, though some viewed the NFT exchanges' intervention as a demonstration that these exchanges can indeed interfere with access to the blockchain.
Developer of "Monkey Jizz" cryptocurrency makes off with $270,000
In a twist absolutely no one could have predicted, the developer of a coin called "Monkey Jizz" ran off with around $270,000. The project promised to share a portion of transactions with all investors, and eventually publish a video game. However, on October 31, the developer set a 94.9% sale fee to discourage people from selling, then transferred out the cash and disappeared.
$60 million disappears in AnubisDAO project within a day of its launch
A project called AnubisDAO launched a coin called ANKH, and were quickly flooded with cash from investors hoping to find another dog-themed memecoin success like Dogecoin or Shiba Inu. In less than 24 hours, the money vanished from the liquidity pool in what project creators claim was a phishing attack, but more likely was a rug pull. One investor interviewed by CNBC said he had invested nearly $470,000 in the coin before the money was drained.
OpenSea NFT trading platform patches a vulnerability that had allowed hackers to steal from users
Bug bounty hunters helped OpenSea patch a cross-site scripting (XSS) vulnerability in their platform that previously allowed attackers to create an NFT from an SVG image, which contained an iframe that would execute JavaScript. Attackers could create an authorization popup that looks legitimate, and if the victim fell for it, gain access to their wallet. OpenSea quickly patched the vulnerability after disclosure, though it appears it had been used in the wild — the bounty hunters began their research after seeing tweets of users who had fallen victim to attackers using the exploit.
A much-hyped Miss Universe NFT project turns out to be a rugpull
Miss Universe and its models, the @nft Instagram, and Steve Harvey all got in on the advertisements for the Miss Universe NFT project, which Miss Universe presenter Paula Shugart said was "going to be the first brand in the NFT space that is about women, about women's empowerment, and embracing the technology, and moving forward. I love it; this is the first one that is away from other more male-oriented spaces." Buyers were offered signed prints, virtual meetings with the models, exclusive events, and a chance to win $50,000. None of this materialized, the Miss Universe Instagram account was deleted, and NFT owners who asked questions began to be banned from the project's Discord channel.
Rapper Tekashi 6ix9ine releases a series of NFTs, only for the project not to deliver anything it promised
$100,000 to charity, governance power over the project funds, a boxing game, and weekly competitions and raffles were all promised as a part of the Tekashi 6ix9ine-backed Trollz NFT collection. However, the project crumbled shortly after it began, with creators removing the ability to mint new NFTs before the designated number were released, a takeover of a Discord bot funneling prospective buyers to scam links, and the rapper deleting any trace of his affiliation with the project. One buyer lost $40,000; around $4 million in total was poured into the apparent scam.
DeFi platform C.R.E.A.M. is hacked for a third time, this time for $130 million
Crypto lending service C.R.E.A.M. Finance lost $130 million in a flash loan attack. It was the third hack of the platform this year, following a $37.5 million hack in February and an $18.8 million attack in August.
A tech startup aims to solve the real problem with the U.S. justice system: the lack of gambling involved
Tech startup "Ryval", which is formally launching in 2022, announced its plans to allow "everyday Americans" to bet on the outcomes of civil lawsuits, potentially raising funds for the parties. While the company is spinning this as "mak[ing] access to justice more affordable", I have considerably less faith that allowing crypto investors to decide on who and what is worthy of a lawsuit (or at least which lawsuits are likely to be "profitable" to them) will somehow introduce more equality into the American legal system.
"Realms of Ruin", a YA storytelling NFT project, collapses hours after launch
Six popular young-adult fiction writers attempted to launch an NFT project where they created a base universe, and participants would contribute their own stories (which they would mint as NFTs) that would be added to the official storyline if the authors liked them enough. Questions around who would own copyright, how teenagers (the target audience) would obtain cryptocurrency and mint NFTs, and environmental impact led the creators to shutter the project only five hours after the launch announcement went out.
- "Inside the Realms of Ruin", TechCrunch
- "Realms Of Ruin Storytelling NFT Collapses After 5 Hours", GameByte
Successful exploit of the CreatureToadz NFT project briefly nets a poorly-disguised hacker 88 ETH (almost $350,000)
A 17-year-old hacker was able to use a phishing webhook to make himself an admin in the CreatureToadz Discord server. Users who minted NFTs unknowingly sent cash to him, netting him a total of around 88 ETH (almost $350,000). However, after the hacker's real identity was uncovered shortly after the attack, the hacker returned the funds, claiming he'd intended to return it all along.
Hacker steals $16 million from Indexed Finance
A hacker drained $16 million from Indexed Finance, a defi protocol built on the Ethereum blockchain. The stolen funds represented nearly half of the total value locked on the platform. The hacker was later revealed to allegedly be an 18-year-old Canadian named Andy Medjedovic, who continued to refuse to return the funds even when his identity was revealed. The hacker argues that he simply took advantage of an arbitrage opportunity, and swore to "fight to the death" in court over his right to keep the money. However, the hacker never showed up to a December court appearance, and a warrant was issued for his arrest.
Four NFT projects on the Solana blockchain rug-pull in one day
Developers behind Solana Towers, an NFT project allowing investors to buy rooms in a metaverse virtual condo as NFTs, disappeared with around $280,000 a day after the project's launch. It was only one of the projects to do so that day, joining the developers behind three other Solana NFT projects: "Interstellar Bots", "Cheesy Dizzy", and "Technidroids".