Web3 is Going Just Great

Crema Finance sent a message to the hacker via Ethereum transaction, writing that "you have 72h from now to consider becoming a white hat and keeping $800k as the bounty... Otherwise the police and legal force will officially get involved and there will be endless tracing waiting for you." On July 6, Crema announced that they had reached an agreement with the hacker, who returned most of the funds and kept 45,455 SOL ($1.68 million) as a "bounty".

Although the terms of the "bounty" agreement suggested that Crema Finance would not involve law enforcement, sometimes these things are out of platforms' hands (or they renege on the agreement). On July 11, 2023, the U.S. Attorney for the Southern District of New York announced charges against Shakeeb Ahmed, a security engineer alleged to have perpetrated the theft.

Crema Finance is not to be confused with C.R.E.A.M. Finance, a crypto lending service that was hacked three separate times in 2021 for a total of nearly $200 million.

Libra-now-Diem ground to a halt after concerns from regulatory bodies and the general public, with Facebook-now-Meta abandoning the project in January 2022. Now they've announced they'll be shutting down Calibra-now-Novi, too, and have advised users to withdraw their balance "as soon as possible". Users won't be able to add money to their accounts beginning on July 21.

Quixotic is the largest NFT marketplace on Optimism, a layer 2 Ethereum network. Despite being the largest marketplace on the network, it still does fairly little in volume compared to NFT marketplaces on other networks, boasting only around $420,000 in trading volume in the last 30 days.

Quixotic paused marketplace activity after discovering the hack, and promised to reimburse all users who had tokens stolen from them.

Polygon's chief information security officer Mudit Gupta told CoinDesk that day that "no funds [were] lost as far as we know but we are still investigating", and that dApps using the Ankr RPC endpoint were non-functional. Ankr later announced that the RPC systems had been fully restored, and that the breach had come from a "third-party vendor" that enabled attackers to change Ankr's domain hosts.

Voyager announced that they were making the decision "given current market conditions", and that it "gives us additional time to continue exploring strategic alternatives with various interested parties". They also released some financial and balance sheet updates that painted a pretty grim picture.

At that price, Coca-Cola will only be earning about $21,500 (minus any expenses) if the project mints out, plus any resale fees. A many-billion-dollar company like Coca-Cola might consider just donating the 20 grand themselves.

Mirror Trading International was founded and operated by Cornelius Johannes Steynberg, who had been on the run from South African police until recently being detained in Brazil on an INTERPOL warrant. The CFTC is seeking full restitution, disgorgement, and bans from future trading.

On September 7, 2023, a U.S. District Court ordered MTI to pay $1.7 billion in restitution.

The scheme ultimately drew in about $12 million from investors, beginning in late 2017. Saffron was charged with one count of conspiracy to commit wire fraud, four counts of wire fraud, one count of conspiracy to commit commodities fraud, and one count of obstruction of justice. If convicted of all charges, he faces up to 115 years in prison.

Previously, in April 2021, the a court ordered Circle Society and Saffron to pay $32 million in relation to the scheme after a default judgment in a lawsuit from the CFTC, who described the whole thing as a Ponzi scheme.

The DoJ alleges that Stollery falsified the TBIS whitepaper, wrote fake testimonials on the project website, and made up business relationships with the U.S. Federal Reserve Board and large companies including Apple, Pfizer, and Disney.

If convicted on all counts, Stollery faces up to 20 years in prison.

All three are facing charges of conspiracy to commit wire fraud and conspiracy to commit securities fraud, and Pires and Goncalves have also been charged with conspiracy to commit international money laundering. If convicted on all counts, Pires and Goncalves face up to 45 years in prison and Nicholas faces up to 25 years in prison.

The people behind the Baller Ape NFT project were also reportedly behind at least two other NFT rug pulls, including "Big Daddy Ape Club". These projects were not mentioned in the DoJ press release.

BlockFi was last valued at $4.8 billion, but FTX is expected to pay around $25 million to buy the company. BlockFi CEO Zac Prince refuted what he described as a "market rumor": "I can 100% confirm that we aren't being sold for $25M." A leaked call with Morgan Creek Digital investors suggested they were trying to counter FTX's offer, and that BlockFi was being valued at less than $500 million. The call also revealed that BlockFi's loan to Three Arrows Capital had been $1 billion, and that it was backed by collateral of $1.33 billion in Bitcoin and GBTC.

CNBC reported that, according to one of their sources, "equity investors in BlockFi are 'wiped out' and are now writing off the value of their losses."

Cryptocurrency has long been touted as a tool for the unbanked, including those who don't have access to banking because they're undocumented, and for people hoping to operate free from government observation. Coinbase, however, has actively courted government contracts such as this one, which has not won them favor among the more libertarian-leaning crypto enthusiasts.

Also on the 29th, the SEC rejected an application from Bitwise to create a Bitcoin exchange-traded product (ETP).

Grayscale immediately announced they would be suing the SEC, a course of action they'd been suggesting for several months. Don't hold your breath, though — a litigation analyst estimated such a lawsuit would take 12–18 months to reach resolution.

W3itch.io apparently decided the best way to accomplish their goal would be to not only steal itch.io's site design, but the source code itself. The games hosted on the website were also taken without the consent from their creators.

After being called out by the KennyNL Twitter account, W3itch.io admitted to stealing the CSS, as well as buying Twitter followers. However, they refused to take the website down, and seemed to claim they were unable to remove listings of stolen games.

The court action followed lawsuits from several creditors over its failure to pay debts. Those creditors included Voyager Digital, who reduced their platform's withdrawal limit after reporting their exposure to 3AC, as well as the crypto exchange Deribit.

A hacker was able to exploit a flaw in the smart contract for the project, stealing crypto notionally worth $3.8 million. The loss to the protocol was likely higher. XCarnival paused its smart contract after learning about the hack from a crypto watchdog.

On June 26, XCarnival announced that they had reached an agreement to give a 1,500 ETH "bug bounty" to the attacker, who agreed to return the remaining 1,587 ETH ($1.9 million) with an agreement that XCarnival would not pursue legal action.

The NFT went up for sale on June 20, with bidding scheduled to last for four days, and a starting bid of 206 ETH (around $240,000). Apparently collectors decided the NFT wasn't enough to justify dropping that kind of cash on a car that is expected to sell for around $90,000, because the auction received no bids.

SuperRare, the marketplace used for the auction, explained that users must have missed the opportunity to bid "due to the craziness of NFT NYC" (a cryptocurrency conference that ran from June 20–23), and the project extended the bidding time by 24 hours. After the 24 hours had elapsed, they still had zero bids.

The Times later updated the story, writing that the company's co-founder told them that the restaurant shuts off the payment system "'from time to time' for upgrades", but was still accepting crypto.

The menu lists prices in USD, not Ether or Apecoin, and most people buy their $13 hamburgers with plain old fiat.

The company announced they would be "scal[ing] down to a target organisational size of about 730 people". The company seems to have had around 1,000 employees, which means they are laying off around a quarter of their workforce. They also announced they would be rescinding employment offers they had extended recently.

On June 23, someone was able to steal assets from the bridge that they then converted to more than 85,800 ETH. The stolen funds are notionally valued at almost $100 million, assuming the thief can cash them out successfully. Hours after the attack, most of the funds remained in the thief's wallet and had not yet been laundered.

A June 29 analysis by blockchain research firm Ellipsis claimed that "there are strong indications that North Korea's Lazarus Group may be responsible for this theft". Lazarus was also behind the $625 million bridge hack in March, targeting the Axie Infinity game.

As one might expect, apparently-unmoderated open comments from some of the most online people out there has been off to a chaotic start. The first comment on the proposal, by a user with a Pepe the Frog avatar, is titled "Taxation is theft!" and reads, "Why should we pay any taxes to a corrupt government that prints money out of thin air and gives it away for free! Eliminate the FED!!! BITCOIN FOREVER!"

Another comment thread begins, "Feds are not looking post floppa" and accumulated over 100 replies containing photos of caracals within half an hour.

A different person submitted a pull request replacing the entire text of the bill with "cryptocurrencies are banned lmao".

On July 13, the creators of the Github repository removed all the issues and archived the repository, apparently bringing the experiment to its end.

The company then posted an announcement that they would be "pausing all withdrawals" due to "extreme market conditions last week & continued uncertainty involving a counterparty". They were cagey about the identity of the counterparty, though the announcement explicitly stated it was not the underwater hedge fund Three Arrows Capital, which has been causing a domino effect throughout the crypto industry. They later alleged the counterparty was Roger Ver, though he denied the claim.

CoinFLEX began allowing customers to withdraw up to 10% of their funds on July 14, but the remaining 90% continued to be inaccessible to them.

Bybit opted to settle with the OSC, disgorging about CA$2.5 million (US$1.9 million) and has begun working with the OSC to become compliant.

OSC accused KuCoin of not complying with the investigation, and permanently banned the exchange from operating in Ontario. The OSC also levied a CA$2 million (US$1.5 million) fine against the exchange.

Later that day, Voyager reduced the daily withdrawal limit from $25,000 to $10,000, suggesting they were having trouble meeting customer demand for withdrawals.

The prior week, Voyager announced they had secured a line of credit from Alameda Research amounting to $200 million in cash and 15,000 Bitcoin. Alameda Research is a trading firm founded by Sam Bankman-Fried, who also runs the FTX crypto exchange.

Almost a year earlier, in June 2021, Vauld raised $25 million in a Series A round led by Peter Thiel's Valar Ventures, which was also joined by Coinbase and Pantera Capital.

The FTX loan represents the second bailout of a crypto firm by Sam Bankman-Fried's companies, after his Alameda Research trading firm extended credit equivalent to around $485 million to floundering crypto platform Voyager.

According to Logically, the "vast majority" of people following the influencers' investment advice "lost anywhere between several hundred and tens of thousands of dollars". One man lost more than $100,000, resulting in him also losing his house and construction business. The man ultimately died by suicide.

He later clarified that he was willing to cooperate with the investigation against TFL, but was dismayed that employees who left long before the collapse were facing an exit ban, and that they weren't notified of the ban.

Terra is facing a class action lawsuit from Korean investors, and local news had previously reported that South Korean authorities had launched an investigation.

Since the last post about an NFT project having its Discord compromised, five days ago, we've seen at least fifteen more projects suffer the same: Clyde, Good Skellas, Duppies, Oak Paradise, Tasties, Yuko Clan, Mono Apes, ApeX Club, Anata, GREED, CITADEL, DegenIslands, Sphynx Underground Society, FUD Bois, and Uncanny Club.

Bancor wrote in their announcement that "Withdrawals performed during this unstable period will not be eligible for IL protection. Users who remain in the protocol will continue earning yields and be entitled to withdraw their fully-protected value when IL protection is reactivated." Many view this as Bancor holding their crypto hostage, because they would take a major loss if they withdrew while IL protection was paused.

The post goes on to say that "two large centralized entities" (likely Celsius and Three Arrows Capital) have rapidly liquidated their $BNT positions and withdrawn a large amount of liquidity; Bancor also wrote that another entity has opened a large short against $BNT.

The proposal allows Solend to temporarily take over the whale's account to liquidate the position "gracefully", rather than allowing the liquidation to happen as it normally would. This stems from the concern that the partial liquidation (20%, or around $21 million) would "cause chaos" on both Solend and the Solana blockchain more broadly. The proposal outlined concerns around Solend potentially ending up with bad debt, and liquidators "spamming the liquidate function" and potentially taking down the Solana chain.

The proposal elicited strongly negative reactions from many in the crypto community, who feel that a project taking over a user's account flies in the face of the concept of defi and sets a dangerous precedent. Others blame Solend for allowing the position in the first place, given the level of systemic risk. Some have also pointed out that Solend may be exposing themselves to legal risk by retroactively changing the terms of the loan.

The proposal succeeded hours after it was proposed, with one whale providing 1 million votes out of the 1.15 million votes in favor.

On June 17, $MIM began to lose its $1 peg, and on June 18 it dropped below $0.91. Later on June 18, it returned above $0.95, but continued to be priced below its intended peg.

The supply of $MIM dropped precipitously in the wake of the Terra collapse, as traders lost confidence in algorithmic stablecoins more broadly. Amidst plummeting markets, rumors have surfaced that Abracadabra is "nearly insolvent" due to bad debt left over from the Terra crash. Sesta has refuted the claim, writing on Twitter that the "treasury has more money than the debt" and that the rumors were simply people "spread[ing] FUD [to] try to recover your losses from shorting a bit". The project announced that it would be implementing "peg stability measures", including increasing interest rates on one of their lending markets.

The same MakerDAO team member wrote in the forum that "Contagion risks in DeFi are increasing", and that the project wanted to "cut exposure" to projects that were in trouble. "We could be dealing with Lehman's moment in crypto," he wrote.

According to the WSJ, 3AC has hired legal and financial advisors to pursue solutions including asset selloffs or rescue by another firm, and is trying to extend the deadlines for outstanding debt repayments.

Some in the crypto space have been encouraging people to withdraw their funds from any type of staking or lending platform, as liquidations and failures to repay debt spreads through the tightly-interconnected ecosystem. On June 16, yield farming platform Finblox implemented a very low cap on the amount of funds customers could withdraw, citing exposure to the apparently insolvent Three Arrows Capital.

The exchange then announced they would be delaying the withdrawals of most popular cryptocurrencies for 36 hours "to avoid unnecessary panic withdrawal". A follow-up blog post the next day announced they would be allowing users to withdraw, but only up to $500 a day. They later adjusted the withdrawal limits to a more flexible model, but left them in place.

As an apology to their customers, AEX promised "AEX Shareholder Badges" to the people with the most funds in their platform. They also announced a Texas Hold'em Carnival to show their "appreciation" of their users, but they canceled it the same day. Perhaps focusing on the liquidity issue is the right choice...

Finblox announced that all users would only be able to withdraw up to $500 a day, up to a monthly maximum of $1,500 — quite a change from the $50,000/day withdrawal limit for some of their users. They also wrote that they would be pausing reward distributions, and delaying their referral program and deposit rewards, and preventing newly registered users from creating new crypto addresses.

Finblox ended the message to their users by saying they would "do everything in its power to protect our users' funds and reinstate our services in full", but such a dramatic move seems to suggest the platform is another domino to fall as companies collapse throughout the crypto ecosystem.

Inverse Finance is a borrowing and lending protocol that was hit with a different oracle manipulation attack in early April, which resulted in a $15.6 million loss.

When 8BC contacted 3AC to make a withdrawal on June 13, they never received a reply. "We didn't think much of it at the time. After a while, the market stablized so we no longer needed the funds. We thought maybe they were just busy." The following day, 8BC noticed $1 million missing from their accounts. When they tried to contact 3AC, they again received no response.

According to Yuan, "What we learned is that they were leveraged long everywhere and were getting margin-called. Instead of answering the margin calls, they ghosted everyone." He called on platforms that still have assets from 3AC to freeze those assets, "so that those who 3AC owes can be paid back in the future after legal proceedings."

These internal values include requiring employees to believe in "The Mission", "to accelerate the worldwide adoption of cryptocurrency". Their culture explainer also includes various points (emphasis in the original):

• "We will engage in lobbying, as a single-issue donor, supporting controversial politicians and legislation that furthers The Mission, possibly to the detriment of other civil rights causes"
• We will advertise with and sponsor controversial television programs, podcasts, influencers and events, if it furthers The Mission
• We may incorporate firearm and self-defense training in to corporate retreats
• Should we aim to be exemplary in terms of stereotypical team diversity measurements? No.

The culture document goes on to say that "Someone Must be Offended, Some of the Time":

• "Krakenites are welcome to request (and deny) personal language and communication preferences of each other"
• Everyone is responsible for their own feelings
• Being offended doesn't necessarily make you right
• Being offended doesn't necessarily make you "harmed"
• Words nor silence are ever "violence"
• We do not call someone's words toxic, hateful, racist, x-phobic, unhelpful, etc.

Throughout the document are various notes to clarify that although some of what they're describing definitely sounds like they might be breaking the law, they're definitely not breaking the law: e.g., "Note: We are committed to eliminating all forms of discrimination against legally protected groups in every jurisdiction in which we operate."

Making matters worse, 3AC co-founder Su Zhu tweeted during the mass sell-off to promote stETH, which certainly gives the appearance that he was trying to pump the price to improve price or liquidity. BlockFi later confirmed that they had liquidated some positions that 3AC held with them.

Speculation about 3AC has swirled, with little comment from 3AC or its executives besides a June 14 tweet from Zhu: "We are in the process of communicating with relevant parties and fully committed to working this out". Meanwhile, other organizations including 8 Blocks Capital have reported that they've been unable to reach 3AC about money they're owed.