A user asked what would happen to remaining seed money, if any, in a Twitter reply. Garfield answered that they "still have a meaningful portion of our seed funding" but that he hadn't decided what to do with it.
Clockwork project to shut down due to "limited commercial upside"
A year after raising $4 million in a seed round joined by Multicoin Capital, Solana Ventures, and Asymmetric, Clockwork co-founder Nick Garfield announced that the Solana-based automation platform would be shutting down. He wrote, "Ultimately the reason we are stepping away now is simple opportunity cost. We admittedly see limited commercial upside in continuing to develop the protocol, and have a growing personal interest to explore new opportunities."
Balancer drained of over $2 million following vulnerability warning
After warning users several days prior that a critical vulnerability had been discovered in their protocol, the Balancer defi project has been drained of around more than $2.1 million in a series of exploits apparently taking advantage of the bug.
Balancer acknowledged the hack, writing on Twitter that "Balancer is aware of an exploit related to the vulnerability [disclosed on August 22]. Mitigation procedures have drastically reduced risks, but [we] are unable to pause affected pools." They reiterated that users needed to withdraw funds from affected liquidity pools to prevent further thefts.
The blockchain researcher known on Twitter as MevRefund questioned why Balancer didn't execute a whitehat attack on their own protocol to try to safeguard the vulnerable funds.
NFT collector SOL Big Brain loses around $1.5 million to phishing scam
The NFT collector SOL Big Brain lost around $1.5 million in ETH, stablecoins, and the Gearbox token after being targeted in a phishing scam. The attacker apparently compromised a Telegram account belonging to a founder of a portfolio company, then used it to message SOL Big Brain to ask him to claim his vested tokens. SOL Big Brain double checked that the sender was indeed the founder of the company, and did as he was instructed.
However, the attacker had set up a contract which used permit phishing to drain SOL Big Brain's wallet. He lost $740,000 in stablecoins, $550,000 in ETH, and another $200,000 in the GEAR token.
"Today is a bad day," wrote SOL Big Brain on Twitter.
Magnate Finance rug pulls for over $5.2 million
Magnate Finance, a lending protocol built on the new Base layer-2 blockchain, rug pulled within hours of a warning from crypto sleuth zachxbt. Zachxbt had discovered that a wallet address used by Magnate Finance was directly linked to Solfire Finance, a project that rug pulled for almost $5 million in January 2022. He warned his followers in a tweet that the project "will likely exit scam in the near future."
Sure enough, within an hour of zachxbt's tweet, the project drained $5.2 million from the protocol and deleted its website and Telegram group.
According to zachxbt, the project also shared on-chain links to the March 2023 Kokomo Finance rug pull, which saw its perpetrators profit around $4.5 million.
Members of $PEPE team allegedly dump $16.9 million worth of tokens
Holders of the $PEPE memecoin sold en masse after the PEPE multisig wallet transferred more than 16 trillion $PEPE (~$16.9 million) to crypto exchanges. Although the multisig previously required five of eight signatories to approve transactions, just before the massive transfer, the multisig was changed to require only two of eight signatures — a much lower level of security.
The transfers and change to the multisig sparked fears that the project was rug pulling, or had been hacked. This led to a massive $PEPE sell-off, with the token plunging around 17%.
A day after the transfers, a PEPE team member posted on the project's Twitter account, alleging that the transfers were indeed theft by three of the project's other team members.
U.S. Drug Enforcement Administration sends over $50,000 to a scammer
After seizing a little more than $500,000 in the Tether stablecoin from two accounts it believed were involved in illegal narcotics sales, the DEA mistakenly sent $50,000 of the seized funds to an enterprising scammer.
Someone observed the DEA wallet send a small test transaction before transferring the remaining seized funds, and quickly used a crypto wallet address with identical characters at the beginning and end to send an airdrop to the DEA source wallet. When the DEA agent went to send the remaining funds, they copied-and-pasted the address, believing it was the same one they'd sent the test transaction to. This is a common scam in the crypto world known as "address poisoning", and is successful primarily because crypto wallet addresses are very long strings of characters that people usually copy-and-paste, and only identify by the characters at the start and end.
Upon discovering that they'd been duped, the DEA contacted Tether to ask them to freeze the funds. However, by that time, the scammer had already converted the money into ETH, which couldn't be frozen. The DEA is now working with the FBI to try to trace the theft.
Former New Jersey prison guard charged by SEC over crypto pump-and-dump scheme targeted at cops
John DeSalvo, a former New Jersey corrections officer, was charged by the SEC over a pump-and-dump scheme associated with his "Blazar" token, a project he targeted at fellow law enforcement. With promises that the Blazar token would "guaranteed minimum 100X your money", DeSalvo convinced around 222 investors to pour in at least $623,888. He also made other false statements, including that the token was registered with the SEC, and that he had devised a way for people to take payroll deductions that would automatically be used to purchase the token.
Rather than "100x-ing", the token immediately plummeted when DeSalvo sold his ~41 billion Blazar tokens. DeSalvo is accused of using his profits from the scheme to speculate on other crypto tokens, pay for personal expenses, and reimburse one investor who threatened legal action.
DeSalvo is also being charged over a separate investment scheme he operated, where he solicited investments on Facebook, promising to use his claimed trading expertise to earn massive returns. The SEC alleges he lost most of the money in bad investments, and stole the rest for himself, blaming the losses on market movements.
DOJ charges two founders of Tornado Cash, arrests one
A year after the Department of Treasury added Tornado Cash to the OFAC sanctions list, the DOJ has come in to charge the service's two founders with conspiracy charges involving money laundering, sanctions violations, and operating an unlicensed money transmitter. The Feds arrested Roman Storm, a U.S. national; Russian co-founder Roman Semenov is "at large".
The Feds claim that the two founders knew Tornado Cash was widely being used to launder hundreds of millions of dollars by North Korea, but "turned a blind eye" and claimed to be complaint with sanctions laws. They also state that they refused to implement anti-money laundering and KYC programs, as is required of money transmitting services.
These charges are likely to be controversial — as has been the sanctioning of Tornado Cash — among crypto advocates and others, as they run up against thorny First Amendment questions and conflicting ideas about who, if anyone, is liable for running decentralized services.
Users pull $150 million in funds from Balancer protocol within hours after reports of a critical vulnerability
Balancer, a popular Ethereum-based defi protocol, has warned users that they should withdraw funds from vulnerable pools on the project after receiving a report of a critical vulnerability. No funds have been lost thus far, and the project has pools that could be impacted, though not all pools can be paused. Because of the nature of crypto projects, Balancer can't simply patch the vulnerability, and is now having to urge users to withdraw their liquidity as soon as possible.
Balancer had around $850 million TVL prior to the announcement. Since revealing the issue, users have removed more than $150 million in assets from the project. Balancer has stated that "only 1.4% of the total TVL is at risk", though 1.4% of $850 million would still be a sizeable $12 million windfall for any potential exploiter.
Victim loses $900,000 to Google Ad phishing
Google Ad phishing is the practice of taking out a Google advertisement to promote a malicious website impersonating a legitimate project. By taking out the ad, the result is pushed to the top of the search results page, tricking unsuspecting victims into believing it's a legitimate search result.
On August 21, an individual searched for "celer bridge" to find the website for the Celer blockchain bridge. The first result appeared legitimate, even displaying the correct URL for the actual Celer bridge. However, once they clicked the result, they were redirected to a phishing website.
Once the victim connected their crypto wallet, it was immediately drained of $900,000 in the USDC stablecoin. They wrote on Twitter that it was "most of [their] net worth".
SEC cracks down on Titan crypto investment manager for advertising 2,700% returns
Titan Global Capital Management, an investment advisory firm, has been charged by the SEC for violations of securities laws, including misrepresenting potential investment performance, making misleading disclosures pertaining to crypto custody, failing to impose limits on employees' crypto trades, and more.
Titan advertised "annualized" performance results of up to 2,700% on its Titan Crypto trading strategy, which the SEC says was misleading because it failed to include material information about how the performance was calculated. Titan had based the calculation on three weeks of performance, assuming it would continue for a full year.
Titan has agreed to a cease-and-desist order, censure, and over a million in disgorgement and penalties.
Harbor Protocol exploited
The "interchain stablecoin protocol" Harbor announced on August 19 that they had experienced an exploit that drained some of the funds in the project pools. They wrote on Twitter that they were "working hard to estimate the total losses incurred as well as investigate the exploiter(s) and trace the funds."
According to data on DefiLlama, TVL on the project dropped from around $370,000 to only $81,000. The TVL was already significantly down from the project's peak of almost $1.5 million.
Crypto founder loses over $250,000 to crypto scam
Bryan Lawrence, the leader of a crypto project called Glow Token, recently shared that he'd fallen victim to scammers impersonating employees of the Crypto.com exchange. Lawrence said that scammers promised to list Glow Token's FLARE token in exchange for more than $250,000 in "security deposits". Crypto.com later contacted Lawrence, asking him to stop falsely claiming that his token would be listed on Crypto.com, and alerting him to the apparent scam.
Lawrence is now suing Crypto.com, although this may be challenging given they apparently weren't behind the scam. Lawrence has also said that he has sold his house to pay for legal costs.
Recur NFT platform shuts down after $50 million Series A
In September 2021, the Recur NFT platform announced it had raised $50 million in a Series A funding round that saw the startup valued at $333 million.
In December 2021, the company offered $300 "Recur Passes", which promised holders early access to NFT drops and other perks. One of them resold for $88,888 in February 2022.
Now, Recur has announced they will be closing up shop, and warned users to migrate their assets away from the platform in advance of a November shutdown. The company cited "unforeseen challenges and shifts in the business landscape".
As for the Recur Passes, they're currently selling for somewhere between $7 and $11.
Terra website hijacked by phisher
Despite the catastrophic Terra/Luna collapse in May 2022, the Terra blockchain is still up and running. On August 19, the official Twitter account for the Terra project tweeted that the project's website had been hijacked, and was being used by a phisher to try to obtain access to users' wallets. When the website is opened, it prompts visitors to connect their wallets, which then allows the phishers to drain funds.
Despite a tweet on August 19 that "sites are coming back online", and a developer stating that they were "mostly back in control", the website apparently remained compromised for several days. The project reiterated via tweet on August 20 that the website was still not safe to use.
It's unclear how much was stolen as a result of the hijacking.
Exactly Protocol hacked for at least $12 million
The Exactly Protocol, an attempt to "decentralize the credit market" built on the Optimism layer-2 network, was exploited. The protocol announced a pause to investigate a security issue, after they were alerted to suspicious transactions.
An attacker has siphoned more than 7,160 ETH (~$12 million) from the project, which they've bridged back to the Ethereum main chain. The Exactly Protocol's TVL plunged from $37 million to under $12 million following the attack.
Exactly writes on their website that they had been audited by four different firms: Chainsafe, Coinspect, ABDK, and Cryptecon.
Fed issues cease and desist to FTX-connected Farmington State Bank
Farmington State Bank, also known as Moonstone Bank, is a tiny Washington state bank that drew scrutiny after the FTX collapse for receiving an outsized investment from the firm. The investment appeared to be an attempt by FTX to gain control of a US bank, and raised questions over how the purchase was approved by federal regulators.
Now, the Federal Reserve Board has issued a cease and desist to Farmington State/Moonstone, claiming they have violated the commitments they made while going through the approval process. Despite promises not to do so, the bank engaged in digital asset activity, reportedly working with stablecoin issuers.
- "Crypto Firm FTX’s Ownership of a U.S. Bank Raises Questions", New York Times
- "Alameda-funded bank Farmington State gets cease and desist from Fed", Protos
- Cease and desist from the Board of Governors of the Federal Reserve System
Blockchain Capital co-founder loses $6.3 million in SIM swap hack
Blockchain Capital co-founder Bart Stephens has filed a lawsuit against as-yet-unknown individuals who he says stole $6.3 million in cryptocurrency from him. The attackers used a SIM swap attack to gain access to his crypto wallet, which they then drained of various tokens.
The attackers also tried to steal around 80 BTC and 6,500 ETH (currently worth over $12.6 million) from a cold wallet belonging to Stephens, but were thwarted by an email alert sent to Blockchain Capital employee.
$1.7 million rendered inaccessible for weeks in broken bridge to new Shibarium network
People were very excited when the Shiba Inu-focused "Shibarium" layer-2 Ethereum blockchain went live on August 16. The dog-themed network is part of a push to make Shiba Inu a "serious blockchain project" — though the network will use $BONE, $TREAT, $SHIB, and $LEASH tokens, and is still fundamentally based around a dog meme.
A bridge between Ethereum and the Shibarium network was released as the network went live, and eager users quickly transferred a combined 954 ETH (~$1.7 million) to the bridge contract so they could access it on the new chain. However, users started reporting that transactions were stalled, and they weren't able to access their tokens on the Shibarium side.
The team quickly shut down conversation on Discord as more issues were raised, and claimed in a blog post that the issues were caused by nothing more than the network being overwhelmed with traffic. The team denied the authenticity of screenshots of a Telegram chat appearing to show the lead developer writing that the funds were unrecoverable, insisting they were safe.
Finally, weeks after the botched launch, Shibarium re-enabled the bridge and told users they could once again access their funds. Though there have been some delays in transactions, the "stuck" funds appear to be retrievable.
SwirlLend rug pulls for around $460,000
Despite the fact that Coinbase's Base blockchain was only officially launched a week ago, and a relatively small amount of funds are locked on the chain, it's already racking up its own tally of scams and hacks.
SwirlLend was a lending protocol operating on both Base and the similarly newborn Linea chain. Shortly after its launch, the project drained a combined $460,000 from the two chains, then deleted its social media accounts.
Shenzhen Shikongyun Technology accused of $83 million Filecoin pyramid scheme
Shenzhen Shikongyun Technology, a company focused on mining the Filecoin token, has been accused of running a pyramid scheme. Four of the company's executives were also charged. According to Chinese law enforcement, they had been soliciting investments in what was ultimately a pyramid scheme, exaggerating the likely returns from their mining efforts.
Shenzhen Shikongyun Technology was operating in mainland China despite a ban on cryptocurrency activities in September 2021.
Prime Trust files for bankruptcy
After the Nevada Financial Institutions Division issued a cease and desist describing Prime Trust as insolvent in June, then successfully requested the company be placed into receivership days later, it's no huge surprise that Prime Trust has filed for bankruptcy.
Prime Trust is a crypto custodian that previously served companies including Binance US, Swan Bitcoin, and BitGo. Just a year ago, the company announced they had raised $100 million in a Series B funding round, and planned to add crypto retirement accounts to its list of products. It's probably a good thing that didn't pan out.
According to bankruptcy documents, Prime Trust has between $50 million and $100 million in assets, but between $100 million and $500 million in liabilities. They report having between 25,000 and 50,000 creditors.
- "Crypto custodian Prime Trust files for Chapter 11 bankruptcy", CoinTelegraph [archive]
- Form 201 in Prime Core Technologies Inc. bankruptcy [archive]
- Tweet thread by Cryptadamist [archive]
RocketSwap exploited after key compromise
Exploiters stole around 471 ETH (~$857,000) from the RocketSwap project on the Base Ethereum layer-2 blockchain. According to RocketSwap, the project had stored private keys on a server which was then hacked via brute force. "We are very sorry for your loss," they wrote on Twitter.
RocketSwap later announced a plan to airdrop tokens to "compensate" users for the theft. They also tried to reassure projects that were migrating away from RocketSwap that there was "no need to run away, your funds are safe".
Zunami Protocol exploited for more than $2.1 million
The Zunami Protocol stablecoin-focused yield farming aggregator was exploited for more than $2.1 million when an attacker was able to perform a price manipulation attack on the project's primary pool. Zunami attracted users by promising "the highest APY on the market": around 14%. The project had been audited by Ackee and HashEx.
The attack was a "classic price manipulation" exploit, according to the Ironblocks security firm. The attacker was able to steal 1,152 ETH ($2.13 million) from the protocol. They then tumbled the stolen funds through Tornado Cash.
Uniswap developer fired over FrensTech rug pull
After pulling off a rug pull that only netted 14 ETH (~$25,900), Allen Lin (known as AzFlin) lost his day job for the company that maintains the Uniswap DEX. Hope it was worth it.
Lin had created a project called "FrensTech", which aimed to capitalize on the popularity of a product called "friends.tech", and which ultimately accumulated the 14 ETH in fees before he decided to drain liquidity. Lin had not tried to conceal his identity. After the rug pull, Uniswap founder Hayden Adams wrote on Twitter: "Wanted to let people know this person is no longer with the company. Not behavior we support or condone."
Lin was unapologetic, tweeting: "got fired from uniswap, but gained 600 new followers and [crypto Twitter] villain status. net neutral tbh".
Bittrex settles with SEC for $24 million
The Bittrex crypto exchange was charged in April by the SEC for operating an unregistered exchange, broker, and clearing agency. In May, Bittrex filed for bankruptcy. Now, Bittrex has agreed to a $24 million fine to settle the charges from the SEC. If approved, Bittrex will have sixty days after filing a liquidation plan to pay the amount to the SEC — $18.4 million of which is disgorgement, plus a $5.6 million fine.
SpiritSwap to shut down after Multichain collapse
SpiritSwap announced on its Discord that the project will be shutting down on September 1 unless they can find a new team to take over the project by that time. SpiritSwap lost their entire project treasury in the collapse of Multichain, and announced that they have "run out of funds to cover the necessary operational costs." The project plans to remain operational until September 1 to remove their liquidity.
SpiritSwap was previously one of the most popular DEXes on Fantom, boasting an all-time-high of $374 million in January. It now has less than $3 million TVL, thanks in part to the Multichain collapse and to the broader cryptocurrency bear market.
SpiritSwap is only the most recent project to announce its closure as a result of the Multichain fiasco. In July, Geist Finance and Hector Network also announced they would be shutting down due to Multichain contagion.
Multiple wallets compromised due to irresponsible encryption in Libbitcoin project
A team of researchers led by the Distrust security research firm have disclosed a vulnerability they've called "Milksad". The popular Libbitcoin project was used by multiple cryptocurrency wallets to generate private keys, but it turns out it was irresponsibly implemented, producing flawed output. The team used a pseudo-random number generator seeded with only 32 bits of system time to produce private keys, meaning that private keys could be brute-forced in "a few days of computation on the average gaming PC, at most".
Nevertheless, when Distrust disclosed this to Libbitcoin, the team replied first that they were too busy, then twice that "they do not feel this is a bug".
The research team has not yet disclosed which wallets were affected by the vulnerability, but they have estimated that around $900,000 were stolen as a result.
Hundred Finance shuts down after hacks
Hundred Finance is a lending protocol that was exploited in April 2023 for around $7 million, and in March for over $6 million. Since then, they've worked with law enforcement and security contractors to recover the funds, but "imminent return of the stolen assets does not appear to be forthcoming."
The project undertook a vote to shut down the lending service, and use remaining funds in the project treasury to try to compensate those who lost funds in the attack. The project also aims to distribute to victims of the hack claims on any funds that might be returned or otherwise recovered in the future.
The vote passed with 99% of votes in support, effectively sunsetting the project.
- "April 2023 Exploit Response Vote", Snapshot
Disney exits the metaverse
Disney has shut off the last light in its metaverse division, parting ways with "metaverse chief" Michael White. In February 2022, Disney's then-CEO described the metaverse as "the next great storytelling frontier". That sentiment appears to have been short-lived, because in March 2023, Disney cut its 50-person metaverse team, leaving only White.
Scammers target victims via web3 job search boards
Scammers are constantly coming up with creative new ways to pull off their scams, and the latest seems to be targeting web3-interested individuals via dedicated web3 jobs portals. One Twitter user described an experience in which he applied for a beta testing job for a play-to-earn crypto game, only to have his wallet drained when he downloaded what was supposed to be the game file, but was actually malware. He lost 875 ARB ($1,032), 60 OP ($140), and various other tokens.
"Jobless and a bit poorer, thanks guys!" he wrote. "You're passionate about its technology, you wanna be part of it. You DCA. You hodl. You do everything you can to do things right... you're passionate, love the space, the tech. The people. Your willingness to get a job in Web3 is enormous! I stand for on-chain values, and I wanna be a part of the wave!" he wrote in frustration, trying to explain how he'd gotten scammed. "The apparent legitimacy of these [web3 job listing] sites made me remove the 'watch out filter', and boom."
Bitsonic CEO arrested for allegedly stealing $7.5 million
Jinwook Shin, CEO of the Bitsonic crypto exchange, was arrested in South Korea for allegedly stealing funds from users of his exchange. According to the prosecutors, he allegedly manipulated prices and trading volumes on the exchange in order to profit around ₩10 billion (~$7.5 million) the beginning of 2019 and mid-2021.
Bitsonic halted its services in August 2021, claiming "internal and external issues". However, even after halting withdrawals, Shin continued to offer cryptocurrency to new clients.
Cypher protocol exploited for around $1 million
The Solana-based Cypher protocol, a decentralized futures exchange, froze its smart contract after an attacker stole a little more than $1 million in Solana tokens and the USDC stablecoin.
The project attempted to contact the hacker to negotiate the return of some of the funds. Meanwhile, various community members sent NFTs to the attacker wallet, requesting the return of the funds. One of them tried to convince the hacker, writing that they believed the attacker's identity could be discovered because they used centralized exchanges with KYC to try to withdraw funds. Another simply said "give it back you shitlord".
Steadefi exploited for over $1 million
"NOTICE: Steadefi has been exploited and all funds are currently at risk," wrote Steadefi on Twitter after an attacker was able to change the contract owner to their own address — likely indicating a private key leak. So far, 624 ETH (~$1.14 million) have been siphoned from the project.
Rumors swirl that Huobi executives have been arrested, exchange is insolvent
Hong Kong crypto news outlet Techub cited two insiders when reporting on August 5 that "at least three executives" at Huobi had been detained by Chinese police for investigation. The report sparked panic, and the exchange has seen net outflows of more than $73 million in the past week. Huobi's stablecoin balances are down 33% over the same period. Investor and crypto analyst Adam Cochran tweeted of "likely Huobi insolvency", citing Binance's bulk Tether sales, paused "audit" reports, and "weird balance shifts" at the exchange.
Huobi and related people have been busy refuting the rumors, with Huobi's social media head dismissing them as "baseless malicious attacks". Huobi "advisor" Justin Sun tweeted "4".
Worldcoin warehouse in Nairobi raided by authorities
After Kenya shut down Worldcoin's operations in the country over data privacy concerns, police have raided a warehouse in Nairobi. Authorities reportedly took "machines they believe stores data gathered by the firm" as well as various documents, according to Kenyan newspaper Kahawa Tungu.
Kenya's Office of the Data Protection Commissioner has said that Worldcoin failed to accurately disclose its intentions with the project when corresponding with regulators.
Copytrader asks for "stolen" funds back after someone tricks their bot
After noticing someone set up a bot to copy his bids, NFT trader Hanwe Chang tricked the bot into purchasing multiple NFTs at hugely inflated prices. Chang purchased a large number of Azuki NFTs using an anonymous wallet, then placed an inflated 50 ETH (~$90,700) bid on one. The bot then came along and offered the same amount on the other NFTs, and Chang accepted the overpriced bids. Altogether, Chang made 800 ETH (~$1.45 million) from the scheme, draining the bot of its available funds. Azukis have been trading with a floor price of around 5 ETH (~$9,000).
The apparent operator of the bot tweeted at Chang, accusing him of theft: "We would like to discuss a bounty with you. We are offering a 10% bounty of any funds stolen from our bot, which are yours to keep if you return the remaining 90%." In other tweets they suggested they might try to take legal action against Chang for the "theft".
Revolut shuts down crypto business in the US
Revolut, a British fintech firm, has announced it will no longer offer cryptocurrency services to its US-based customer. As is becoming typical, they blamed US regulations and "crypto market uncertainty" for the decision.
Revolut had previously been one of the crypto platforms to limit US trading in Solana, Cardano, and Polygon tokens after the SEC identified those tokens as securities in lawsuits against Binance and Coinbase.
Web3 platform Nifty's shuts down
Nifty's was a web3 business backed by the likes of Mark Cuban, Joey Lubin, Coinbase, and Dapper Labs. In 2021, they raised a $10 million seed round, and launched as an NFT-focused company in July 2021 with a collection of Space Jam NFTs to accompany the widely panned box office disappointment, Space Jam: A New Legacy.
The platform later partnered with other companies to produce NFT collections for franchises including The Matrix and Game of Thrones, the latter of which featured hilariously bad artwork. The company then pivoted to a broader web3 focus as the NFT bubble collapse led the broader crypto downturn.
However, their promised web3 platform never materialized, and now the project has reached "the end of [its] runway".
Nifty's is not to be confused with Nifty Gateway, a separate NFT platform run by the embattled Gemini crypto platform.
Uwerx crypto-based freelancer platform exploited
Uwerx is a nascent project intending to build a blockchain-based freelancer marketplace, because what better concepts to combine than blockchains and the gig economy? Sadly for them, just after completing their token presale, it was hit with a flash loan exploit that enabled an attacker to siphon 176 ETH (~$324,000) from the platform.
The project was audited by SolidProof and InterFi. The project announced that they intended to relaunch the token, and asked the exploiter to consider returning 80% of the funds, keeping 20% as a "bug bounty".
LeetSwap exploited on Base
Although Coinbase's Base blockchain is at this stage intended for testing only, people have begun bridging substantial assets to the platform and using various services in anticipation of its official launch.
One such service is LeetSwap, which describes itself as the "The #1 DEX ecosystem for elite degens built on the leetest blockchains", and which recently launched its service on Base. On August 1, LeetSwap was exploited after an attacker discovered a function that allowed them to manipulate token prices on the project for a profit of around 342 ETH (~$624,000).
LeetSwap attempted to contact the hacker via social media, asking them to return all but 50 ETH (~$92,000, or around 15% of the stolen funds).
Phisher briefly snags $20 million before it's frozen by Tether
A zero-transfer attack, also called an address poisoning attack, occurs when a phisher creates a blockchain address very similar to that of a target victim's wallet, and sends zero-value token transactions to the victim's addresses from the phishing wallet in hopes that the victim will later mistake the phishing address for the real one and send funds to it. It sounds unlikely to work, but users often fail to verify every character of the destination address they're using, opting instead to copy it from their transaction histories, and this can profit scammers substantially.
Someone intending to transfer Tether stablecoins amounting to $20 million apparently didn't think it was important to double-check the address, and fell for such an attack.
However, only 51 minutes after the theft, the victim had managed to get Tether to add the thief's address to its blacklist, freezing the assets and thwarting the attack. The rapidity of the freeze led various people to question who the victim might be who could get Tether to intervene so quickly.
- "Tether Freezes $20 Million Linked To Phishing Scammer", CryptoPotato
BALD memecoin plunges after $25.6 million rug pull
A memecoin called $BALD, built on the Coinbase Base test network, appears to have rug pulled for at least $25.6 million. Although the Base network is meant to be used for developer testing, some people have tried to trade on the network before its official launch.
A pseudonymous crypto user called "Bald" announced that they would be selling $BALD tokens on the Base network, and the token — apparently named after the hairless Coinbase CEO Brian Armstrong — quickly skyrocketed in price. However, the token deployer emptied tokens priced at around $25.6 million from the liquidity pool two days after launch in apparent rug pull. The token price quickly plunged by around 90%.
Conspiracy theories emerged that the Bald account was in fact operated by Sam Bankman-Fried, the former CEO of FTX who is on house arrest under strict supervision and without access to most websites as he awaits trial later this year.
SEC goes after Richard Heart and his projects Hex, PulseChain, and PulseX
The SEC filed charges against Richard Heart, the operator of Hex, PulseChain, and PulseX. Despite Heart's best attempts at evading securities laws — including by asking people to "sacrifice" tokens in exchange for PLS and PLSX to avoid using the term "invest" — the SEC says he's been conducting unregistered securities offerings amounting to more than $1 billion.
In addition to the unregistered offerings charge, the SEC alleges Heart and PulseChain misappropriated $12.1 million to fund Heart's lavish lifestyle. Among other things, he purchased a McLaren sports car, five luxury watches, and a $4.3 million 555-carat black diamond called "Enigma", allegedly using funds from the sale.
Bug in Vyper smart contract language enables multiple exploits on Curve and related projects
Some types of Curve factory pools, including one operated by AlchemixFi and one by JPEG'd, were exploited. The attack stemmed from an issue in the Vyper language, a smart contract programming language that is similar to Solidity. Early investigations suggested that versions of the Vyper compiler had improperly implemented a re-entrancy guard, leaving some projects vulnerable to that type of attack. Vyper tweeted an announcement that the versions were vulnerable, and urged "projects relying on these versions [to] immediately reach out to us".
Curve itself lost $61 million to the exploit. AlchemixFi was exploited for around $13 million in assets, and JPEG'd suffered a $11 million loss. MetronomeDAO suffered a $1.6 million loss, Ellipsis Finance lost $68,600, and Debridge Finance lost around $24,600.
Altogether, somewhere between $88 million and $100 million was taken, though some exploits appeared to be whitehat actions intended to preserve funds. The primary exploiter also later returned some of the stolen funds, refunding the entire amount to AlchemixFi and 90% of funds to JPEG'd in exchange for a 10% "bug bounty".
Kannagi Finance rug pulls for over $2 million
The defi yield aggregator project Kannagi Finance rug pulled on July 29 as its creators drained the $2.13 million total value locked. Kannagi Finance deleted its website and social media accounts following the exit scam.
Blockchain security firm SolidProof had audited Kannagi in June.
Memecoin launch by Pauly0x costs traders at least $2.2 million
Traders hoping to get in on the next big memecoin eagerly snapped up a token called Pond0x, a Pepe the Frog-branded memecoin launched by Pauly0x. Pauly0x is Jeremy Cahen, a crypto personality best known for his creation of CryptoPhunks, NotLarvaLabs, and involvement in the Ryder Ripps lawsuit.
However, serious flaws in the Pond0x contract resulted in traders losing at least $2.2 million as people discovered that anyone could transfer coins belonging to other people. People quickly began rushing to steal coins from one another.
Pauly0x responded by blaming the traders who bought and sold the tokens, and spent the following day variously posting on Twitter that he was teaching people a lesson, that it wasn't his fault that people lost money, and suggesting that the flaw was part of a bigger plan for the project. "No one stole your tokens lol. The contract is literally designed as such," he wrote to angry traders accusing him of a rug pull. He added to the website a message reading, "GREED KILLS".
DeFiLabs rug pulls for $1.6 million
A defi project called DeFiLabs was able to rug pull for $1.6 million thanks to a backdoor written into the smart contract. After traders bought into the project, its creator was able to call the
withdrawFunds function to make off with the project's assets.DeFiLabs claimed on Twitter that the platform "encountered an unexpected issue" while "undergoing maintenance and updates".
DeFiLabs had been audited by blockchain security firm CertiK.
- "DeFiLabs", Rekt
CoinsPaid hacked for $37.3 million
The CoinsPaid crypto payment platform, which provides payment services to various online casinos, reportedly suspended withdrawals under mysterious circumstances. The company later deleted a handful of tweets pertaining to the incident, which they ascribed to a "technical issue".
After prominent Bitcoiner Jameson Lopp tweeted that the issue "look[s] more like a hack", CoinsPaid replied "Our team is aware of the issue... Please wait for the official announcement on this topic." Crypto researcher zachxbt responded, "The issue is you got hacked by North Korea that's what lol", referencing the increasing suspicion that the Lazarus group may be behind the disruption. Sure enough, CoinsPaid later confirmed that they had been hacked for $37.3 million, and announced that they suspected the Lazarus Group was behind it.
Some have been speculating that there are connections between this incident and the $60 million hack of the Alphapo crypto payments processor on July 22. Alphapo also provided services to various online casinos. Indeed, there seem to be connections between Alphapo and CoinsPaid, and they may in fact be operated by the same people.
EraLend exploited for $3.4 million
The EraLend crypto lending platform was exploited for around $3.4 million after an attacker took advantage of a re-entrancy vulnerability to manipulate token prices and drain funds from the project. The thief then quickly distributed the stolen funds across various wallets and blockchains.
EraLend paused various functions of their protocol while they investigated the attack, and said they were working with various security research organizations and law enforcement to investigate the theft.
The BlockSec security research firm warned other projects that re-used a portion of code to be cautious if they re-used a portion of code from SyncSwap, because they could also be vulnerable.