DeezNutz_404 hacked for $170,000

I might otherwise skip over news of a $170,000 hack, given how commonly thefts of that scale happen in the crypto world, but with a name like this... come on.

One thing that keeps me from ever trying my hand as a crypto project hacker is that if I made $170,000 from exploiting a project called "DeezNutz_404", I would immediately be caught because I wouldn't be able to resist telling everyone I know that I'd just made enough money to not have to work for a couple years by exploiting deez nuts.

Anyway, there was a bug in their code that allowed an attacker to mint infinite tokens and steal around 58.65 ETH (~$170,000).

Axie Infinity co-founder suffers $9.5 million loss after wallet compromise

Jeff "Jihoz" Zirlin, a co-founder of the Axie Infinity blockchain game, lost around $9.5 million as two of his crypto wallets were compromised. The thief stole 3,248 ETH ($9.5 million), which they quickly laundered with the Tornado Cash cryptocurrency mixer.

Some were briefly concerned that Axie Infinity's Ronin Bridge had been hacked (again), since the funds moved out of the bridge. Jihoz and others were quick to emphasize that the bridge had not been affected, and it was simply a personal wallet compromise.

Influencer "Crypto Rover" accused of pump-and-dump and other shady behavior

Influencer "Crypto Rover" taking a selfie with an exaggerated concerned expression, and the bitcoin logo next to himCrypto Rover (attribution)
A popular cryptocurrency influencer known as "Crypto Rover" has been accused by blockchain sleuth zachxbt of shady behavior, including accepting promotional payments from crypto projects and then not following through on his end of the deal, dumping tokens after promising followers he would hold, and secretly purchasing tokens for memecoin projects before pumping the price by posting about them.

Zachxbt outlined various incidents, including how Crypto Rover purchased "Stoned Pepe" tokens before posting to his hundreds of thousands of followers that he thought the token would "do at least a 10x", and claiming that he had inside info on the project. He also detailed how Rover had taken a $10,000 payment and 1% of the supply of a new token that he promised to promote, then never promoted — despite promising the team that he could "pump projects from 1/2m to 10m easy".

After zachxbt published his research, Rover deleted his Telegram channel.

Over $55 million taken from defunct AAX crypto exchange

The Hong Kong-based AAX cryptocurrency exchange suspended withdrawals in November 2022, only days after the FTX collapse and related chaos in the cryptocurrency world. They claimed that user funds were safe, but the exchange never restored service. A month later, police arrested two of the company's executives.

Now, over a year later, the Cyvers blockchain security firm has observed more than 24,000 ETH (~$55.6 million) has been moved from wallets used by the platform. Although there could be innocuous explanations for money moving off a defunct platform, whoever was moving the funds used various decentralized services to launder the money, appearing to be trying to make it more difficult to trace.

Airdrop hunters spam Github projects

A Github issue titled "github" with the text "i'm a scroll contributor"Airdrop farming Github issue (attribution)
After projects like Celestia and Starknet distributed airdrops of crypto tokens to people who had contributed to their open source Github repositories, airdrop hunters have begun spamming other projects in hope that they might one day receive tokens for their "contributions". In the recent Starknet airdrop, one individual received 1,800 STRK (~$3,200 at current estimates, though the token isn't actively trading yet) for an unmerged pull request fixing a typo in project documentation, so the hope that relatively trivial contributions could result in a windfall isn't completely unjustified.

Several repositories for crypto projects that have not launched tokens were inundated with hundreds of trivial Github issues apparently written in the hopes that in the event of an airdrop, they would be considered contributions.

"Please don't submit a GitHub issue just for farming purposes," wrote one employee of a crypto project receiving such spammy contributions. "The [project] core team is stretched thin enough as it is, please don't make our lives harder." Several projects had to limit who was allowed to open new issues in their repositories to try to tackle the spam.

FixedFloat exchange hacked for $26 million

The FixedFloat cryptocurrency exchange was exploited for around 409 BTC (~$21.17 million) and 1,728 ETH (~$4.85 million) for a total loss of just over $26 million. FixedFloat is a decentralized cryptocurrency exchange that doesn't require user registration or Know Your Customer, making it popular for hackers looking to launder stolen funds.

FixedFloat first wrote that they had "encountered some minor technical problems", then acknowledged that there had been a hack. FixedFloat is non-custodial, so no user funds were impacted, however some have reported frozen transactions and missing funds from using the service on social media.

Yuga Labs acquires Moonbirds amid speculation of insider trading

Pixel art of a white owl with one squinting eye, wearing a forest ranger hat, on a light green backgroundMoonbirds #768 (attribution)
On February 16, the NFT giant Yuga Labs announced it would be acquiring the Moonbirds NFT project. This adds to list of blue-chip NFT collections controlled by Yuga Labs, which already included their original Bored Ape Yacht Club and spin-off NFT collections, and the CryptoPunks and Meebits collections they acquired in March 2022. Decentralized!

Anyway, after the acquisition was announced, prices for Moonbirds spiked, as was to be expected.

What wasn't expected was a notable spike in trading in the days leading up to the acquisition announcement, in which some wallets began accumulating large amounts of Moonbirds and related NFTs. One such wallet purchased 80 Moonbirds, 71 Moonbird Mythics, 28 Oddities, and 13 Mythic eggs in the week leading up to the announcement, and enjoyed several hundred thousand dollars in profits after the acquisition was announced.

Trader loses $4.5 million in phishing attack

A trader known as kirilm.eth fell victim to a phishing attack, losing over 180 million BEAM tokens to a scammer. BEAM is a token belonging to the Beam blockchain gaming network, built by the Merit Circle DAO.

The stolen tokens were notionally priced at around $5.14 million, although the sale of the stolen tokens resulted in a price drop that meant the attacker ultimately was only able to trade them for 1,629 ETH (~$4.5 million). The BEAM price dropped around 10%.

YouTuber KSI accused of pump-and-dump

Crypto sleuths Coffeezilla and zachxbt teamed up on an investigation into YouTuber and crypto promoter KSI, accusing him of pumping up interest into the XCAD project and then dumping tokens priced at $850,000 shortly after, when some of his millions of followers had likely bought in and pumped the price.

Although the token dumping occurred in March 2022, zachxbt waited until now — when KSI returned to his dormant Twitter account — to release the evidence he'd collected.

KSI had previously claimed to followers that he was "holding his bags", meaning not selling the XCAD tokens he'd purchased or been given. zachxbt determined this to have been a lie. The XCAD founder later came to KSI's defense, claiming he had bought more tokens than he sold, as though that somehow justifies the behavior.

"Decentralized" social network Farcaster criticized after confiscating channel name to be used by influential crypto podcasters

Conversation with Dan Romero
Romero
hey there
/bankless wants their channel :)
can I refund you $25 worth of USDC on Base

Sender
Dan with all due respect, bankless is a brand using a common word that has been in our space for a decad
If I was using their logo and perpetrating like I was them, that would be different
This sets a really poor precedent.

Romero
Do you have examples of where you are using Bankless?
happy to be convinced otherwiseConversation between the accused squatter and Farcaster co-founder Dan Romero (attribution)
One of the promises made by proponents of crypto-focused decentralized social networks like Farcaster is that you can't be de-platformed by centralized companies, and you maintain control over your own presence on these platforms.

This made it a bit of a shock when the co-founder of the a16z-backed Farcaster blockchain-based social network messaged a user to inform them that he would be taking away the channel name he had registered, whether he agreed to it or not. According to the co-founder, Dan Romero, the popular Bankless crypto podcast had requested the bankless channel name, which the user he was messaging had already registered.

After the user argued back against Romero's offer of $25 in USDC to reimburse him for the channel name, and said it set a poor precedent, Romero stated: "ok this isn't productive. do you want USDC for the refund or warps" (referring to the non-crypto points used by the Warpcast client for Farcaster).

On one hand, some criticized the user who had registered the name for allegedly squatting on the channel name and trying to resell it. Romero defended his decision by arguing, "I never said channels were decentralized yet" (though the platform does generally claim to be "sufficiently decentralized"). Others argued the action set a bad precedent, and flew in the face of the ethos supposedly motivating these types of web3 social networks.

Romero has promised on Twitter that Farcaster channels "will be onchain later this year and like [user identifiers] won't be able to be touched." When pushed on the precedent this sets, he replied, "So let the squatter extort money?" Romero clearly needs to grapple with the fact that, like it or not, squatting is a feature of systems that take a hands-off approach to managing access to identifiers. This should not be news to anyone remotely familiar with the web, where "domaining" emerged out of the relatively laissez-faire structure of DNS — though unlike with fully decentralized identifiers, there can be some intervention when domain name speculation enters the realm of cybersquatting.

Creator of "Robotos" NFT project, once collaborating on a TV series with TIME studios, accused of rug pull

A doodle of a robot with a gold crown, a blue suit jacket over a white shirt and black tie, and pink eyesRoboto #2767 (attribution)
Pablo Stanley, an artist who created the "Robotos" generative NFT collection, posted two final messages from the Robotos Twitter account. First, "it was a good run! thank u, all!", then an image of the Twitter log-out button with "forever and ever".

Rewind to November 2021, when it was announced that TIME Magazine's film and production studio would be collaborating with Stanley to develop a children's animated TV show based on the Robotos NFTs. The announcement helped to drive interest in the NFT collection, which reached a peak floor price of around 1.5 ETH (~$5,000 at the time).

Since then, no show has materialized, and the collection's floor price has dwindled. NFTs from the collection have recently sold for around 0.015 ETH (~$42). In the project Discord, Stanley claimed that TIME had lost interest in the project after the writer's strike. He also wrote that he had lost faith in web3: "Glad you still believe. It's hard for me to believe in it anymore." He explained that he had viewed Robotos as a "personal side project", and that he was "sorry if that's not enough for most people, but that's all I have the appetite for, and that's all I can offer."

Duelbits crypto casino exploited for $4.6 million

The Duelbits crypto casino and sports betting website was drained of around $4.6 million on both the Ethereum and BNB Chain blockchains. The funds were quickly bridged or exchanged to ETH.

It appears that the thief got access to a Duelbits wallet, perhaps through a private key compromise.

Yuga Labs bungles "free" Otherside NFT drop

An illustration of a grey cylinder, seemingly made from stone, with glowing gold light inside it appearing through some cracks and designsyuga-ship-part (attribution)
Some fans of Yuga Labs (the company behind Bored Apes and the much-anticipated Otherside metaverse gaming project) are questioning how much progress the company can really have made on the as-yet-unreleased flagship Otherside gaming project, if they managed to screw up an NFT design this badly.

Yuga released a new NFT, intending to function as ship parts that could be combined to create a ship to be used in the game. Players who had completed an Otherside minigame would be eligible to mint these NFTs for free. However, the "free" NFT cost around $30 in gas fees to mint. Worse still, the parts were meant to be repeatedly traded and combined to make new parts and ships, leading fans to wonder why on earth they decided to release the project on a blockchain where each transaction often costs tens of dollars.

Apparently realizing they'd made a mistake, Yuga first responded by announcing they would gift people free "Catalyst" NFTs to make it up to them. This only sparked further rage, though, as it was seen to dilute the value of the Catalyst NFTs and throw off incentives.

Yuga later reversed course on this decision, instead deciding to reimburse the gas fees.

This was not Yuga Labs' first gas-related fiasco, after they caused gas fees to spike into the thousands of dollars across the entire Ethereum network in April 2022 during the initial Otherside land sale.

One observer wrote, "[W]hat's the plan for the marketplace in Otherside that is supposed to support millions of daily microtransaction? I'm afraid this means Otherside is much less developed than we would like to hope. These decisions are entry level mistakes, not mistakes we should see from the biggest company in the space developing a metaverse. If the Otherside mint wasn't an eye opener, then this wont be either."

PlayDapp crypto gaming platform exploited, spurring misleading headlines

The South Korean blockchain gaming platform PlayDapp was hacked on February 9, and an attacker minted 200 million $PLA tokens. These were notionally priced at around $36.5 million, although because only 577 million $PLA were in circulation before the unauthorized mint, there would not have been sufficient liquidity for the attacker to sell them at around that price.

Days after the initial attack, on February 12, the attacker minted another 1.59 billion $PLA. This has led to news reports that the platform was exploited for "$290 million". However, this value is being naively calculated based on the token price without taking into account the massive supply inflation, and ignoring that that dollar figure is more than 2.5x the total claimed market cap of the token. Even reputable outlets like Bleeping Computer have printed the figure in their headline (though Bleeping Computer later changed the headline to a more accurate one).

PlayDapp sent on-chain messages to the attacker, offering a bounty, but the offer was ignored.

Solana goes down for five hours

They were doing so well! After suffering a slew of outages during 2022, Solana had seemed to get their act together in 2023 with only one major outage. Now, however, Solana has gone offline again for five hours.

With blockchains promising to become "world computers" upon which anyone can create projects ranging from mere toys to critical infrastructure, uptime is crucial, and a five-hour-long outage is devastating.

SIM swappers charged over hacks, reportedly including FTX

Three people running a SIM swapping operation have been charged with fraud and identity theft. By gaining access to the personal information of their victims and then convincing cell phone providers to "swap" victims' phone numbers to phones they controlled, they were then able to gain access to various accounts controlled by their victims.

Although the indictment does not name FTX, Bloomberg has reported that "victim company-1" named in the court filings was FTX, which was hacked for around $400 million amid the chaos as the company was collapsing.

Crypto exchange created by Three Arrows Capital founders to shut down

Who can believe this. OPNX, the crypto derivatives exchange created by the people who ran and then blew up the Three Arrows Capital hedge fund, will be shutting down. The exchange was originally announced in January 2023, with a tentative name of "GTX" — "because G comes after F", they said. It was created as an evolution of the CoinFLEX exchange, which had become insolvent and halted withdrawals in June 2022. Much of the exchange's focus was on allowing creditors of bankrupt cryptocurrency projects to trade their claims — including claims on Three Arrows Capital.

Now, as Su Zhu emerges from several months in jail, he, Kyle Davies, and the other executives of OPNX are shutting down the project. Traders have a week to settle their positions, and another week before the platform closes entirely.

Both Zhu and Davies are, of course, trying to promote a new crypto derivatives trading project.

More than $58 million stolen in Twitter phishing schemes in January

Scam Sniffer's January 2024 report describes more than 40,000 victims who collectively lost more than $58 million thanks to various phishing schemes on the Twitter platform.

The top seven victims collectively lost $17 million, with the top victim alone losing $4.7 million.

$112.5 million in XRP stolen from Ripple CEO Chris Larsen

Chris LarsenChris Larsen (attribution)
Blockchain sleuth zachxbt noticed the strange movement of around 213 million XRP, the native token for the Ripple project. These tokens were priced at around $112.5 million at the time of the theft. He originally identified the source of funds as Ripple itself, though Ripple CEO Chris Larsen later went on Twitter to claim that the funds that were stolen had come from his personal wallets and not from wallets belonging to the Ripple project.

Larsen attempted to downplay the massive theft, claiming repeatedly that the theft did not represent a threat to Ripple itself, and trying to reassure people that Ripple wallets are still safe. However, fears over a threat to Ripple itself and the true separation between Larsen's wallets and those belonging to the Ripple project continued, and XRP dipped around 5% on the news.

Abracadabra exploited for almost $6.5 million, Magic Internet Money stablecoin depegs

Well that sure is a headline I just had to write.

The Magic Internet Money ($MIM) stablecoin has lost its dollar peg again, dipping all the way below $0.77 in a flash crash before returning to around $0.95.

The depeg appears to be related to an exploit of the Abracadabra lending protocol, which allows people to borrow $MIM. An attacker exploited an apparent flaw in the platform's smart contracts to drain around $6.5 million.

This is the second time the token has depegged, after a June 2022 incident shortly after the Terra collapse.

HyperVerse founder Sam Lee charged

US Attorneys in Maryland and the US Securities and Exchange Commission filed criminal and civil lawsuits, respectively, against Sam Lee, the co-founder of the HyperVerse cryptocurrency investment scheme, which has defrauded victims of between $1.3 billion and $1.9 billion depending on whose estimate you use. The US Attorneys have accused Lee of securities fraud and wire fraud. The SEC has accused Lee and a major HyperVerse promoter, Brenda Indah Chunga (aka "Bitcoin Beautee"), of securities fraud and offering unregistered securities.

This is the second HyperVerse related criminal charge in recent days, following the arrest of promoter "Bitcoin Rodney".

Goledo Finance hacked for $1.7 million

Goledo Finance, an Aave-based lending protocol, was exploited through a flash loan attack. The attacker stole assets estimated by CertiK at around $1.7 million.

Goledo Finance contacted the attacker to offer a 10% "bounty" for the return of the remaining assets. In a message on January 29, the attacker wrote: "I hacked Goledo and want to negotiate".

Korean crypto karaoke platform Somesing hacked

Have you ever gone out to karaoke and thought "man, the only thing missing from this perfect night is a blockchain"? No? Weird.

Anyway, the South Korean Somesing platform — which is really more of a TikTok-but-just-for-song-covers clone than anything to do with karaoke — suffered a breach in which 730 million SSX tokens were stolen. These tokens are nominally priced at around $11.5 million, but around 2/3 of the stolen tokens were as yet undistributed and not a part of the circulating supply.

8,100 Bitcoin forfeited by Silk Road drugs distributor in guilty plea

The US government is cementing its status as one of the largest BTC holders by adding another 8,100 BTC (priced at almost $350 million today) to its stash. The tokens were forfeited in a plea agreement from Banmeet Singh, who sold large quantities of drugs including fentanyl, LSD, ecstasy, Xanax, Ketamine and Tramadol on various dark web marketplaces including the Silk Road.

Singh pled guilty to conspiracy to possess with the intent to distribute controlled substances and conspiracy to commit money laundering, charges for which he's expected to serve around 8 years in prison.

WallStreetMemes token price plummets after staking contract exploited

Hackers were able to exploit a vulnerability in the staking contract for WallStreetMemes ($WSM), a memecoin and online casino project targeted at the "meme warriors" who frequent various financial meme communities, many of which formed around the Gamestop short squeeze.

The attackers were able to siphon 769 million $WSM from the contract, which was notionally worth around $7 million. However, the token lacks liquidity to support swapping hundreds of millions of tokens without depressing the price, and the token price dropped around 35% in the wake of the attack as the thief began to cash out over several days.

Meanwhile, WSM announced that they would be issuing a new token to replace the stolen tokens, and "renew[ing] the liquidity pool"... somehow.

MailerLite hack enables over $700,000 in crypto phishing thefts

A phishing email appearing to come from WalletConnect: "You're invited!
We hope this email finds you well and thriving in the world of decentralized finance! Today, we're thrilled to bring you an exclusive celebration that promises to elevate your crypto experience to new heights.
This is not just another airdrop; it's a rare opportunity to amplify your crypto portfolio and be part of something extraordinary. The team at WalletConnect, in collaboration with Web3Inbox, is hosting a special occasion to express our gratitude to our valued users and community members."WalletConnect phishing email (attribution)
After hackers gained access to various accounts on the MailerLite email marketing software via a social engineering attack on an employee, they were able to send malicious phishing emails that appeared as though they had been genuinely sent from companies including the CoinTelegraph crypto media outlet and the crypto firms Wallet Connect, Token Terminal, SocialFi, and De.Fi.

The emails appeared to announce airdrops and exclusive offers from those companies, and recipients were invited to connect their wallets to claim tokens. Those wallets were then drained.

The attackers stole a variety of cryptocurrencies, and some outlets have reported the theft has totalled more than $3.3 million. However, because a substantial amount of that number comes from the illiquid Xbanking token, the actual liquid value of the tokens is likely closer to $700,000. The attackers have begun mixing the stolen funds through the Railgun privacy service.

Animoca Brands-owned Gamee tokens stolen

An attacker was able to gain access to the Gamee (GMEE) token's source code repository, then exploit a vulnerability in the code to transfer 600 million GMEE tokens to their own wallets. At the token's market price of $0.025 before the hack, these tokens were ostensibly priced at $15 million, though the token value plunged around 60% to below $0.01 following the theft as the attacker began selling the tokens.

GMEE is the token belonging to the Gamee blockchain-based gaming platform, which was acquired by the Animoca Brands company in 2020. Animoca is mostly known for its crypto-metaverse project, The Sandbox.

Concentric Finance exploited for $1.8 million

The Concentric Finance yield aggregator project issued a statement that the protocol had been exploited after a social engineering attack on a team member that had access to the project's deployer wallet.

Tokens priced at around $1.8 million were drained from the project vaults. In a tweet, Concentric urged users to revoke contract approvals to avoid further losses.

The wallet addresses used by the exploiter appeared to connect the attacker to the $2.7 million OKX DEX theft in December 2023.

Terraform Labs files for bankruptcy

Terraform Labs, the company behind the Terra blockchain, has filed for bankruptcy. Its flagship product, the Terra stablecoin and associated LUNA token, failed spectacularly in May 2022. Its CEO, Do Kwon, was arrested in March 2023, and remains in custody awaiting a decision on whether he will be extradited to the United States or South Korea — both of which are looking to charge him over his role in the scheme.

Despite all of that, Terraform Labs had continued to operate. However, it is now in dire financial straits, and has now filed for Chapter 11 bankruptcy in an attempt to sort out its financial obligations amid costly legal cases. Terraform Labs is currently a defendant in a complaint by the SEC, as well as several class-action lawsuits.

According to the company's bankruptcy filing, it has between $100 million and $500 million in assets, and liabilities in the same range.

Dwight Howard's NFT project flops

An illustration of Dwight Howard in 3/4 profile, wearing shades with "Ballers" across the front in LEDs, and a tank top with the Avalanche logo pinned on a strapBallers NFT project artwork (attribution)
NBA star Dwight Howard is clearly at least a year (probably two) late to the time when celebrities and star athletes could drop some low-effort NFTs and sell out the whole batch immediately. After announcing his "Ballers" project on January 20, offering 3,000 NFTs for a mint price of 2 AVAX (~$60) apiece, he only managed to sell about 300 of them within a day or so.

After the dismal launch, Howard tried a few somewhat desperate-seeming moves to try to attract interest in the project: promising to send free crypto to some holders, redoing all the art after criticism of its quality, and slashing the NFT supply to 1,500. Despite all that, only 465 NFTs have sold (15% of the original supply, netting Howard 930 AVAX — around $28,400).

The flop was so bad that a member of the team behind the Avalanche blockchain put out a tweet distancing themselves from the project, stating that they didn't even know about the project until he announced it. "Gone are the days that individuals/Brands with large followings can just drop IP related NFTs out of nowhere and expect it to do well," they wrote, seemingly criticizing Howard's approach by writing that NFT creators must "mak[e] sure to do it in an organic way with proper intentions."

CFTC files complaint against Debiex platform for using "romance scam tactics" to steal $2.3 million

The CFTC has filed a complaint against Debiex, a shadowy cryptocurrency platform whose precise location and executives are unknown. The company's employees primarily targeted Chinese Americans, and used common romance scam techniques: first striking up a friendship or romantic relationship with the victim, then convincing them that they could earn huge profits by putting money on Debiex.

Debiex, however, only resembled a cryptocurrency trading platform. In reality, the website merely mimicked a trading platform, and the funds supposedly deposited there for trading purposes were taken by Debiex.

The CFTC identified five victims who were allegedly defrauded of a combined $2.3 million.

Colorado pastor charged for cryptocurrency scam he says he perpetrated at God's command

A still frame from a video of a man speaking to a camera, with the subtitles: "So the charges are that Kaitlyn and I pocketed $1.3 million and I just want to come out and say that those uh charges are true."Eli Regalado (attribution)
A Colorado-based pastor for an online ministry sold INDXcoin to his followers and others in the Christian faith. However, there was no way for buyers to cash out the tokens. Meanwhile, Regalado and his wife spent the money on a Rolls Royce, jewelry, and designer handbags — and, according to Regalado, "a home renovation the Lord told us to do."

Regalado posted a video to his supporters explaining that he had been sued by the Colorado state securities regulator. "So the charges are that Kaitlyn and I pocketed $1.3 million, and I just want to come out and say that those uh charges are true," said Regalado in the video, presumably causing a cold chill to run down the spine of his defense attorney in the middle of whatever he was doing.

According to Regalado, God told them to first invest in a separate coin, which turned out to be a scam. Then, says Regalado, God told him to make his own currency, which Regalado called INDXcoin, "but also give them a 10x". Who knew God was a degen! Regalado had told investors that the funds would be going to "widows and orphans", but spent most of it on himself and his wife.

Luis Rubiales' NFT launch condemns "radicalism and feminist extremism" and describes alleged assault as "a small mistake"

Luis RubialesLuis Rubiales (attribution)
Apparently, former president of the Royal Spanish Football Federation Luis Rubiales has decided the way to rehabilitate his reputation after forcibly kissing a soccer player and being banned from football is to... release an NFT project.

In an announcement posted on Rubiales' Twitter account, the South Korean Moon Labs wrote: "Yes, we agree that Mr. Luis Rubiales made a small mistake in women world cup." The statement went on to condemn "extremism and radical feminism", and downplay Rubiales' actions as not "really" sexual assault. "Yes, Luis did small mistake but probably the biggest mistake was losing Luis Rubiales in football part [sic]."

$2.7 million disappears from funds meant to compensate Hector Network investors

In July 2023, angry investors in the Hector Network project opted to "rage quit" — an option reserved by some defi projects that allows investors to vote to liquidate a project's remaining treasury and distribute it to token holders. The successful rage-quit vote in Hector's case came after the protocol lost $8 million in the Multichain disaster, although investors say that was only the final straw in a series of poor management choices and inflated salaries that saw the project treasury dwindle from over $100 million to around $16 million.

Now, another $2.7 million is gone after an apparent thief was able to exploit a smart contract that was intended to distribute payouts to Hector's token holders. They then swapped the tokens from the USDC stablecoin to ETH.

Investors in the project are furious, especially because various parties had warned Hector Network about apparently insecure practices. Hector Network's team, meanwhile, have not acknowledged the theft, although a law firm involved in the project liquidation promised a statement would be forthcoming.

TrueUSD loses peg (again) as traders sell due to fears over its stability

TrueUSD, a stablecoin connected to Justin Sun, deviated from its intended $1 peg to around $0.983 as traders sold off more than $100 million of the token seeking safer options. The fears seemed to be sparked by the rapidfire and massive hacks of the Justin Sun-connected HTX (hacked for $115 million) and Poloniex (hacked for $120 million) in November.

Adding to those is the fact that TrueUSD recently paused its real-time reserves attestations, due to systems reporting liabilities that exceeded assets, though TrueUSD (obviously) claimed this was just an error.

Socket service and its Bungee bridge suffer $3.3 million theft

The Socket cross-chain infrastructure protocol was hacked for around $3.3 million in an attack that exploited its Bungee bridge. The thieves were able to exploit a bug that allowed them to take assets from those who had granted approval to a portion of the system called SocketGateway.

A little over 700 victims were affected, and the highest loss from a single wallet was around $657,000. 121 wallets lost assets priced at more than $10,000.

On January 23, the protocol announced they had recovered 1,032 ETH (~$2.23 million) of the stolen funds.

Gamestop is shutting down its NFT marketplace

Just as the NFT marketplace was entering collapse in May 2022, GameStop decided it would be a great time to launch an NFT marketplace. The marketplace launched in July, and made headlines for a rather unfortunate reason.

Evidently the platform has still been running since then, though it rarely enjoys much mention alongside its many competitors.

Now, rolling out the classic "regulatory uncertainty" line, GameStop has announced it will be shutting down the marketplace. After shutting down a crypto wallet project in November, the company seems to have fully exited the crypto world.

Harmony blockchain encounters "infinite mint" bug; accusations of wrongdoing fly

On December 7, the Harmony blockchain began encountering a bug that ultimately caused around 150 million of the project's $ONE token (priced at around $2.2 million) to be erroneously minted and distributed to 79 wallets. Most of the recipients, who were anonymous, quickly sold their unexpected windfall.

The bug was fixed about a week later. There has been a dispute since then between Harmony employees and a consultant who was involved in identifying the bug, and the consultant has been accused of delaying action to profit from the excess tokens. The consultant also balked at destroying some of the tokens he mistakenly received.

The consultant claims that he didn't profit from the bug, and objected to a Harmony employee coming after him to destroy the excess tokens when he'd done little towards others who profited from the error. He did, however, say later that he had destroyed the tokens.

According to the consultant, a Harmony employee claimed that he had filed reports to the FBI and IRS about the consultant's behavior, and had the consultant banned from the annual ETH Denver event.

Genesis to settle with New York for $8 million

After the New York Department of Financial Services accused the Genesis cryptocurrency platform of cybersecurity failures that made it vulnerable to criminal activity and hacking threats, Genesis has reached an $8 million settlement with the agency.

The failures included poor anti-money laundering programs, deficiencies around filing suspicious activity reports, and poor cybersecurity.

The NYDFS action is only one of Genesis' many worries these days, as it undergoes bankruptcy proceedings and is facing various other legal woes.

Euler Finance cofounder loses private key and, with it, $3.8 million

As Euler Finance tried to recover from a massive hack in March 2023, and as founder co-founder Michael Bentley was dealing with matters in his personal life, he "made an error and it turns out that one of the private keys [to his personal crypto wallet] is no longer recoverable". The private key would have allowed him to recover assets from his hardware wallet, which had made his assets inaccessible after a malfunction.

With the malfunctioning hardware wallet and no recovery key, Bentley has lost access to assets including 1.2 million EUL tokens — over 4% of the total EUL token supply. These tokens are priced at about $3.8 million today, though at other times the tokens would have been worth up to about $15 million.

"I've now lost a substantial percentage of the crypto assets I held in cold storage, accumulated over more than seven years, including the majority of the EUL allocated to me for participating in Euler governance," said Bentley.

Trader loses $5.7 million to slippage in memecoin trade

A shiba inu dog wearing a chunky light pink knit hat with a brimDogwifhat's namesake (attribution)
A trader looking to buy $9 million of a recently popular Solana memecoin, dogwifhat (WIF), lost $5.7 million of their funds to slippage as they placed a massive order in a pool with relatively low liquidity. $5.7 million of their funds were lost to "slippage" — the discrepancy in price that can occur when a trade is so large or a market is so illiquid that the trade itself impacts the asset price.

Some have speculated that the trade might be an expensive marketing stunt to increase attention to WIF, which was losing some steam.

I'll give it to them: the token's namesake is pretty cute. But not $9 million cute.

So long, hexagon: Twitter removes NFT profile picture support

Just about two years after launching a feature in which NFT owners could show off their NFTs with special, hexagonal profile pictures, Twitter has apparently removed support for adding NFT avatars.

It's unclear if the move is spurred by the massively waning interest in NFTs, or if it's part of Twitter's broad slashing of functionality in the wake of Elon Musk's disastrous takeover and cost-cutting attempts.

Those who already had the hexagonal profile pictures now seem to have had them restored to their usual circular shape, and there's no longer any mention of the feature in Twitter's support documentation, and new NFT profile photos can't be uploaded. People can, of course, still right-click and save the images and upload them that way.

SEC Twitter account compromised, used to falsely announce approval of bitcoin spot ETFs

As the crypto industry collectively turns blue holding its breath for a decision on a raft of bitcoin spot ETFs currently in front of the SEC, the SEC Twitter account was hacked. The hacker posted an announcement stating that the Commission had approved bitcoin ETFs, even including a graphic with a fake quote from Chairman Gary Gensler.

Bitcoin briefly spiked by about $1,000 before dipping around $1,000 below its previous price, as traders excitedly reacted to the news, and then the news that the news was fake.

"Bitcoin Rodney" arrested in relation to Hyperverse scam

A man wearing a denim bucket hat and vest with the Gucci logo, a white button-down shirt, large black glasses, a massive gold and diamond chain, and two watches, poses in front of a backgroundBitcoin Rodney (attribution)
A crypto influencer known as "Bitcoin Rodney" was arrested by US authorities for his involvement in the HyperVerse crypto scam, which fleeced victims out of over $1 billion. In addition to promoting the scam, Bitcoin Rodney allegedly received more than $7.8 million directly from victims, which he exchanged for HyperVerse's $HU token. $5.8 million of this money was received after HyperVerse had disabled converting $HU to cryptocurrency, meaning that the victims never even had the opportunity to cash out their "investments".

Bitcoin Rodney has been charged with operating an unlicensed money transmitting business and conspiracy to operate an unlicensed money transmitting business.

"Undead Apes Society" creator charged over rug pull

A grey ape skull on a blue background with clouds. The skull has a pink and green mohawk, a laser module for eyes, and teeth resembling piano keys. It's wearing a shredded white dress shirt with a tie.Undead Ape #1 (attribution)
The creator of a Solana-based NFT project called Undead Apes Society has been charged with money laundering conspiracy and making false statements to investigators after rug-pulling fans of his NFT project. Devin Rhoden, an active duty Senior Airman in the US Air Force, had created the project and minted two collections: UndeadApes and Undead Lady Apes. They promised to then mint a third collection, "Undead Tombstones", which was highly anticipated. However, the project turned out to be a rug pull, and the prices of the two previous collections also plummeted as a result of their connection to a scam project. The Undead Tombstones project raised 1,250 SOL in April 2022, which was at the time priced at around $128,000.

When investigators subpoenaed Discord for Rhoden's chat logs, they found messages celebrating the rug pull. "good shit on us making a fuck ton of money," he wrote to his co-conspirator.

MangoFarmSOL rug pulls for $2 million

A Solana yield farming project called MangoFarmSOL encouraged people to deposit Solana tokens into the protocol to earn airdrops by January 10. However, on January 6, the project appeared to make off with all the tokens — around $2 million worth. They subsequently deleted their website and Twitter account, and closed their Telegram channel to new members.

MangoFarmSOL is unrelated to the other Solana-based mango-themed project, Mango Markets, which was exploited in October 2022 for more than $100 million.

Narwhal likely exit scams for $1.5 million

A cryptocurrency project called Narwhal appears to have rug-pulled, claiming that they were hacked. In a post on their Twitter account, they claimed that a "hacker attack" caused "significant losses to [their] community members", but urged followers to "maintain trust in the platform".

However, investigation by the CertiK blockchain security firm suggests that the "hack" may have been an inside job, with much of the $1.5 million that was "stolen" going to wallets with links to the Narwhal team.

The Narwhal project had launched in mid-December.

xKingdom rug pulls for $1.25 million

The xKingdom project promised users a way to "build your kingdom" on Twitter, earning tokens by interacting with tweets and doing "quests". Users had to borrow XKING tokens in order to participate.

On January 6, the project's creators drained the tokens that had been put into the project, then deleted their website and social media accounts. Altogether, they withdrew 558.3 ETH (~$1.25 million).

CoinsPaid hacked again

The crypto payments platform CoinsPaid was hacked for the second time in six months. This time, around $7.5 million in various tokens was stolen.

In July 2023, an attacker stole $37.3 million from the CoinsPaid platform. CoinsPaid said at the time that they suspected the attacker was the North Korean Lazarus hacking group, which has been a prolific perpetrator of cryptocurrency thefts.

Blockchain security firm CertiK suffers compromise of their own

The Twitter account of the blockchain security company CertiK was hacked, then used to post tweets ostensibly warning of a massive crypto vulnerability and urging users to click a link to protect their wallets, but which instead linked the account's some 340,000+ followers to a site that would drain their wallets if connected.

CertiK quickly regained control of the account and deleted the tweets, later explaining that an employee had been contacted by a "verified account, associated with well-known media". The journalist's account, apparently compromised, successfully phished the CertiK employee by sending what looked like a Calendly meeting scheduling link, but what was in fact a malicious link used to take over the CertiK Twitter account.

Blockchain sleuth zachxbt criticized CertiK, which describes itself as a leading blockchain security firm, for not protecting against the attack, and asked if they would be reimbursing phishing victims.