Web3 is Going Just Great

The thief quickly flipped all of the NFTs for around 417 ETH ($525,000). It's unclear if one of the CryptoPunks was stolen, as it was transferred to a wallet to whom CryptoNovo has previously made transfers, but that NFT too was sold for 75 ETH ($94,200).

The thief made a pretty penny, but the loss to CryptoNovo is more substantial based on how much money they spent on the NFTs. They had purchased the Bored Ape in August 2021 for 30 ETH (then around $100,000), and CryptoPunk #4608 in September 2021 for 290 ETH (then $850,000).

The attack appears to have been phishing-related.

Early last year, Coinbase was ordered by regulators to hire an outside monitor to oversee compliance. Under the settlement agreement, Coinbase will be required to continue the monitoring for at least another year as it works to improve its compliance.

Magic Eden acknowledged the issue in a tweet, asking users to contact their support if they had bought any of the fake NFTs. Various users on Twitter had reported buying the spoofed NFTs, paying 20–50 SOL ($266–$666) for fake NFTs that appeared as though they were a part of a verified collection that usually sold for around 165 SOL ($2,200).

Clicking in to the NFT details showed that they were a part of a different collection that was not verified, but they appeared in listings among the verified NFTs, and were in some cases quickly purchased by collectors who thought they were taking advantage of a seller's mistake in listing the NFT.

Giannaros told Axios that the company was "still operating but will be scaling back".

The sudden sale of such a large number GMX tokens (which are comparatively illiquid compared to much larger cryptocurrencies like Ethereum) caused the price to suddenly drop from ~$41.50 to ~$38 per token, though the token price recovered fairly quickly. GMX is the native token for the defi exchange of the same name.

"What the fuck is happening, why my 5 years old kid watching porn JPEGs on [Magic Eden's] website" tweeted one shocked user.

The issue was resolved fairly quickly, although some visitors continued to see the unsavory images for a while longer due to browser caching.

On January 3, he released a statement on Twitter explaining that he had become addicted to gambling over the past year — specifically mentioning his use of the Stake cryptocurrency casino. He wrote, "Every dollar I could find I would put into Stake in hopes of winning big. Even when the big wins did happen it wasn’t enough. Eventually I lost everything. In addition to my own life savings, I also irresponsibly used investor funds to try and 'get my money back' from the casino which was wrong for so many reasons."

The impact on the projects he created — and those who put money into them — is not yet fully clear.

Gopalani tweeted that "I was hacked by a clever Phisher (same phone # as apple ID) & sold all my clone x / some other nfts... Obviously pretty upset and hurt by this and I havent really been able to move all day." He didn't provide further details, but a tweet by RTFKT CTO Samuel Cardillo suggested that Gopalani may have provided passwords or private keys to a phisher.

On January 2, Cameron Winklevoss — one of the twin brothers who operates Gemini — published an open letter on Twitter to Barry Silbert, the founder and CEO of DCG, which is the parent company of Genesis. DCG also has a substantial amount of money that they have borrowed from Genesis.

"More than 340,000 Earn users ... are looking for answers. These users aren't just numbers on a spreadsheet, they are real people. A single mom who lent her son's education money to you. A father who lent his son's bar mitzvah money to you. A husband and wife who lent their life savings to you. A school teacher who lent his children's college funds to you. A policeman, and so many more. All together, these people entrusted more than $900 million of their assets to you," wrote Winklevoss, without any apparent self-reflection on the fact that these words could just as easily have been (and should also be) addressed to him by those same customers of his service.

Dashjr complained on Twitter about having trouble getting in contact with the FBI about the theft. Some joked about the irony of a Bitcoin maximalist running to the FBI when his coins were stolen.

There are some questions about the veracity of Dashjr's claims, given his supposed security practices, the extent of the breach, and some of his odd comments on Twitter.

The firm had attempted to keep up appearances that all was well, spending lavishly and even opening new offices several weeks before entering bankruptcy. However, it turns out that employee pension contributions had not been being paid since early summer. Employee salaries had not been paid since October.

"This tool really helped me unload those embarrassing early NFT Hype investments. Should shave about $1000 off my tax bill", a supposed user writes in a testimonial blurb on the site (although the testimonials appear to be faked).

Perhaps someone has finally found a viable crypto business model after all.

Altogether, an estimated $1.7 million was moved through various services to obfuscate the flow of funds.

3Commas did not come off looking very good after this incident, after they spent weeks denying any breach and accusing those who were concerned 3Commas had been compromised of spreading misinformation and "FUD".

Researcher zachxbt wrote that he had verified 44 victims who had lost a combined $14.8 million due to the leak, although he acknowledged that this was only the number of people he could verify and that the total number of people affected was likely much higher.

Users with assets on the platform will see a significant haircut in what they are allowed to withdraw. Midas intends to keep 55% of the Bitcoin, ETH, or stablecoins held by users in their accounts, as well as any rewards users had earned.

Lest the users be too upset that more than half of their assets no longer belong to them, fear not: Midas will be making up the difference in a new, valueless token that does not yet exist, but that will be associated with some future project that Midas has not described yet. You're welcome!

They've also announced they will be pivoting to "CeDeFi". Yes, that is indeed short for "centralized decentralized finance". No, I am not joking.

It quickly became apparent that a man named Avraham Eisenberg was behind the exploit. In screenshots leaked from a conversation in a private Discord channel shortly before the attack, Eisenberg talked about the exploit he had planned. "I'm investigating a platform that could maybe lead to a 9 figure payday. Should I do it?" he wrote. When someone replied, "unles[s] it is highly illegal", Eisenberg responded: "Are there rules these days?" When someone suggested responsibly disclosing the vulnerability to the protocol, Eisenberg refused, saying the bug bounty was likely to be too small.

Eisenberg later owned up to the attack, tweeting a thread in which he wrote that he "was involved with a team that operated a highly profitable trading strategy last week. I believe all of our actions were legal open market actions, using the protocol as designed, even if the development team did not fully anticipate all the consequences of setting parameters the way they are."

The feds apparently disagreed with his evaluation, and arrested Eisenberg in Puerto Rico on December 26. He is charged with commodities fraud and commodities manipulation.

BTC.com is the seventh largest Bitcoin mining pool, which also operates other crypto mining services. Its parent company, BIT Mining, is publicly traded on the NSYE.

BitKeep has claimed that attackers were able to compromise a version of their software and introduce malicious code which enabled them to drain user funds. BitKeep recommended their users contact the team behind BNB Chain on social media to plead with them to freeze an address used by the hackers, although the attackers had already begun to tumble the funds.

This is the second BitKeep-related hack in the last few months. In October, hackers stole more than $1 million worth of BNB when the Swap feature of the BitKeep wallet was exploited.

Rubic paused their project to limit further thefts, and stated they would pursue audits before coming back online. They also stated that they would "strive to compensate for the losses".

Now, Hong Kong police have arrested Liang Haoming and Thor Chan, two executives connected to AAX. Police have reportedly accused the men of using the maintenance excuse to halt customer withdrawals while dealing with a liquidity crisis.

Observers were quick to notice that the "hack" was made possible by the addition of a fake collateral token, which was then manipulated to liquidate the protocol's users, suggesting the "hack" was likely an inside job.

On December 26, Defrost claimed that the "hacker" had miraculously returned the money. The announcement didn't seem to convince the project's users, who left comments like, "It was never hacked. You tried to rug your users".

Defrost Finance's team had previously run a project called FinNexus, which also suffered a "hack" in May 2021 that was widely believed to have been a rug pull.

Now, it seems that The Pokémon Company International (TPCI) is doing something about it. They hired private investigators to try to locate and serve a company called Kotiota with legal papers, though ultimately were unsuccessful in finding their offices or any employees.

Kotiota was engaged in unusually brazen Pokéfraud, sending legal letters to news outlets who had written about the real Pokémon games and insisting they be named as a developer. Their website falsely claimed Kotiota had been working on various recent Pokémon games, and the company had even forged an agreement with TPCI to claim they had a license agreement.

Kotiota had been planning to release a Pokémon-based play-to-earn blockchain game and collection of NFTs in January 2023, but an Australian court has barred the company from doing so, and ordered them to stop using the Pokémon brand or claiming to have developed the games.

Ellison's and Wang's pleas were announced in a short message by U.S. Attorney Damian Williams, who did not elaborate on what the charges were. He again urged any others who had knowledge of criminal activity at FTX to come forward, and warned that these were not the last charges he expected to file.

Simultaneously with the charges from the Justice Department were civil complaints from the Securities and Exchange Commission, which alleged that both had been involved "in a multiyear scheme to defraud equity investors in FTX". In particular, the SEC accused Ellison of artificially manipulating the price of FTT, the FTX-issued token that formed a large portion of Alameda's balance sheet. The SEC accused Wang of creating a backdoor in FTX software that allowed Alameda to move customer funds from FTX for use in its trading activities.

The CFTC filed an amendment to their complaint against Sam Bankman-Fried, adding Ellison and Wang as defendants.

So close. You're almost there.

Paxful CEO Ray Youssef said in an email to the platform's claimed 11.6 million customers that the decision was based on Ethereum moving from proof-of-work to proof-of-stake, not being decentralized, and spawning an ecosystem of scammy Ethereum-based altcoins. The email featured a header photo of Youssef himself posing triumphantly, and Youssef spent much of the subsequent day tweeting memes he made from pictures of himself.

With the loss of ether, the platform will only allow swaps of Bitcoin, Tether (USDT), and USDC — despite both Tether and USDC being Ethereum-based tokens.

"Rates starting at 7.5%, with 80% Bitcoin upside appreciation", they say. Downside risk is, naturally, not mentioned.

For those unfamiliar, Swan Bitcoin is a US-based Bitcoin-only crypto platform (although CEO Klippsten would surely yell at me for saying it is a "crypto platform", as he insists at every opportunity that "Bitcoin is not crypto").

Core Scientific is only one of many Bitcoin miners in distress, as low Bitcoin prices and other factors make mining much less profitable. Other mining firms, including Argo Blockchain and Greenidge Generation, have warned that they may face bankruptcy in the near future. Some firms, such as Iris Energy, have powered off a significant amount of their mining capacity.

Now, however, Auros is seeking a "light touch" liquidation path that would allow them to continue operations while they develop a restructuring plan. Meanwhile, they have missed another Maple loan repayment, this time for $7.5 million.

Court filings have revealed that "a significant proportion of the Company's assets" are frozen with FTX, leaving the company insolvent. These assets have an estimated value of $20 million.

The USDN stablecoin remained within a few cents of its intended USD peg for about a year, before losing its peg in April. Since then, it has had a pretty bumpy road, spending much of the year more than a few cents off the dollar peg, and dropping much farther below it in early November.

A less-than-enthused commenter responded to Ivanov's Twitter announcement of a new coin, writing, "My brother in Christ more stablecoins to depeg is not the answer". "It will be undepeggable", replied Ivanov. Well, in that case.

After some back-and-forth, with legitimate-looking contracts and falsified emails appearing to come from the real company's real founding director, the NFT collector was asked to use their crypto wallet to sign a contract, via the fake company partner website that had been set up.

When the collector did so, the smart contract drained the collector's wallet of its fourteen pricey Bored Ape NFTs, then accepted the highest offers that were outstanding on each of the Bored Apes, netting 852.9 ETH. The scammer converted the stolen ETH to the DAI stablecoin, making off with $1,075,000 in DAI.

Now, someone has moved 104 BTC (priced at $1.75 million today) from what is supposed to be a Quadriga cold wallet. In 2019, Quadriga's bankruptcy trustee Ernst & Young revealed they had erroneously transferred these roughly 100 Bitcoin to that wallet, which they could not access. Oops.

Most of the stolen BTC was transferred to a privacy service to obfuscate its ultimate destination. Ernst & Young subsequently confirmed the transfers were "unauthorized transactions" and not performed by them.

Raydium claims the exploit was a trojan attack, though they've provided no further evidence to substantiate this. According to Raydium, a trojan allowed an attacker to compromise the private key belonging to the pool owner account. With control over the private key, the attacker was able to withdraw a mix of assets from the pools. They bridged at least $2 million to Ethereum and tumbled them through Tornado Cash; another $1.5 million remained on the Solana chain, where some projects began freezing assets.

Raydium has offered a 10% "bug bounty" to the hacker if they return the stolen funds.

On December 7, a branch of Mazars Group had published a "proof of reserves" report for Binance — though it only accounted for Bitcoin, and did not reflect liabilities for Binance's lending product. On December 9, Crypto.com also published a "proof of reserves" report that had been produced by the firm.

As of December 16, the Binance audit — which had been hosted on Mazar's website — had been deleted.

"Proof of reserves" reports have been offered by various cryptocurrency exchanges in lieu of proper audits, but have reasonably failed to reassure many customers of those exchanges. These reports do not involve the scrutiny that would be applied by a full audit — they only reflect a snapshot of assets at a point in time, and do not show a firm's liabilities.

Trump supporters got all excited when Trump posted on social media to tease a "major announcement". Was he going to run for speaker of the House? Return to Twitter? Unveil a presidential running mate?

His supporters were surprised — and not exactly thrilled — when the announcement turned out to be a collection of 45,000 NFTs (sorry, "digital trading cards") featuring artwork of himself in heroic outfits and poses. The NFTs are "just" $99 apiece, and money goes to Trump, not his campaign.

Even some of his strongest supporters were nonplussed. Steve Bannon said, "I can't do this anymore," and opined that he should fire whoever advised him to make the collection. A source working for Trump said that he is "supposed to be running for president right now", and questioned how "fleecing our supporters for $99" was in service of that goal.

Nevertheless, the NFTs seemed to sell decently well, with more than 30,000 minted by that evening.

These mass withdrawals signal concerns about Binance, whose users are looking for reassurance that the company is not engaged in similarly shady practices as their now bankrupt rival FTX. Recent news that the US Department of Justice is considering criminal charges against the company has not helped reassure customers.

As a result of the inadvertent publication of bankruptcy documents, the London Stock Exchange and Nasdaq paused trading on the company's stock. The company published a statement saying they had requested trading be re-enabled, since they had not actually filed for bankruptcy (yet).

Reuters reports that Binance's defense attorneys have argued, among other things, that "a criminal prosecution would wreak havoc on a crypto market already in a prolonged downturn." Well then.

In case you were wondering, I checked, and yes. Someone has already come up with the concept of metaverse mortgages.

Personally, I'm excited to see other horrific parts of the system of homeownership get recreated virtually. Metaverse homeowners associations. Metaverse building permit red tape. Metaverse NIMBYs. Metaverse property liens. Metaverse neighborhood watch.

According to Lodestar, they think they may be able to recover around $2.4 million of the stolen funds. Meanwhile, they have attempted to contact the thief to try to negotiate the return of stolen funds. "We will generously reward your collaboration," they wrote on Twitter.

Now it has come to light that McCaffrey had actually taken a series of loans amounting to $43 million from Sam Bankman-Fried, founder of the now-collapsed FTX exchange and Alameda trading firm. According to McCaffrey and various others at The Block, he was the only one who knew of the arrangement.

The original $12 million loan was used for the company buyout. Another $15 million loan in January 2022 went towards company operations. A third $16 million loan was used... to buy personal real estate in the Bahamas.

Meanwhile, The Block's disclosures page reads, "It is critical that The Block is fully transparent about our own financial holdings so as to avoid any appearance of bias or impropriety. The most valuable asset that we hold and strive to earn again every day is our reader's trust. Therefore, we have implemented a financial disclosure policy that is industry leading."

The promoters listed in the lawsuit are: talent manager Guy Oseary, digital artist Beeple, Madonna, Paris Hilton, Jimmy Fallon and related entities, Justin Bieber, Gwyneth Paltrow, Serena Williams, Diplo, Post Malone, Snoop Dogg, Kevin Hart, the Chainsmokers, Steph Curry, Future, The Weeknd, DJ Khaled, and Adidas.

An investigation by OKHotshot has reported that Sierra rug pulled the NFT project, using project funds to wash trade her own NFTs before cashing out. In total, she withdrew 120 ETH (at the time worth around $316,000; today worth around $151,000). Throughout, Sierra claimed that "absolutely none of the funding has been taken by founders".

In addition to the allegations around her NFT project, OKHotshot identified other shady behavior by Sierra, such as pumping-and-dumping other NFTs she'd purchased, and placing lowball offers in $DAI on big-ticket NFTs, hoping that their owners would mistake them for ETH.

After OKHotshot published the thread, Sierra blocked them on Twitter, and deleted the NFT project's Twitter account and website.

Some of Digital Surge's customers reported having entrusted the company with hundreds of thousands of dollars from their superannuation funds (retirement pension). "I lost everything," said one customer who had put his entire superannuation of more than AU$150,000 (~US$102,000) into his Digital Surge account, where it is now frozen.

However, NFTs that had been minted on the FTX platform relied on metadata from an API at that domain, meaning that the NFTs are now pointing to broken links. Owners of these NFTs can still see that the NFT exists, but images no longer work—even when viewing the NFTs in their own wallets, or when listing them for sale on other platforms.

Other projects that rely on the FTX NFT platform's API, such as the Coachella NFT project, also broke: the Coachella NFT platform shows 0 NFTs in existence. Those NFTs still show up where they are listed on external NFT platforms, although the images and metadata are broken.

The layoffs were reportedly "terribly" executed, with days of uncertainty and employees receiving little or no notice before being fired.

Swyftx's CEO admitted the company had grown too fast. He attributed the decision to the continued downturn in the crypto market and shaken trust as a result of FTX, though Swyftx says they had no direct exposure to the bankrupt crypto exchange.

On December 3, Orthogonal Trading admitted to Maple that they were unable to meet loan repayments. The group was unable to repay a $10 million loan due the following day. The group has $36 million in liabilities across various loans on Maple's USDC and wETH pools.

Orthogonal Credit, a sister group to Orthogonal Trading, published a blog post distancing themselves, writing that they were "shocked and dismayed" by Trading's misrepresentation. "We are speechless by the extent of the exposure and liquidity position of Orthogonal Trading’s book of business," they wrote. They attributed the insolvency to FTX exposure.

In a Twitter thread, Bybit CEO attributed the layoffs to the "deepening bear market" and said the layoffs touch all departments.

"We are all saddened by the fact this reorganisation will impact many of our dear Bybuddies and some of our oldest friends," he wrote. On the bright side, they no longer have to be called "Bybuddies".

Gemini has formed a creditor committee to try to recoup funds from Genesis, as well as Genesis parent company DCG.

On November 28, the company's vice president for global marketing and communications acknowledged that he had resigned from the company, explaining on Twitter that "I did fight for the community but none of the initiatives we came up with were accepted."

Upon realizing that the exchange was unlikely to resume withdrawals, some customers have taken it upon themselves to try to find AAX's executives. Some showed up at the Hong Kong headquarters, only to find it deserted. Another user appeared at their Singaporean coworking space, also to find it empty. Users have been posting leaked personal identity documents of listed executives on Telegram, hoping to locate them.