Galaxy Digital agrees to $200 million settlement over alleged LUNA manipulation

A January 2022 tweet by Mike Novogratz, with a photo of his shoulder sporting a fresh tattoo of a wolf howling in front of a moon with a banner reading "LUNA". The tweet text reads "I'm officially a Lunatic!!! Thanks @stablekwon And thank you my friends at Smith Street Tattoos."Mike Novogratz tweet (attribution)
While many crypto firms have escaped enforcement actions from federal regulators thanks to massive industry lobbying, state enforcers are still on the beat. Crypto investment firm Galaxy Digital, headed by Mike Novogratz, has agreed to pay $200 million to settle market manipulation charges from the New York Attorney General, which accused Novogratz and his firm of promoting the token without disclosing they had acquired discounted tokens they were selling off at substantial profit.

In addition to promoting the token through the usual means, Novogratz got a large tattoo on his shoulder representing the token. Sadly for him, although the LUNA token would later fade away after crashing in spectacular (and fraudulent) fashion, tattoos are forever.

HyperLiquid loses $13.5 million in alleged JELLYJELLY manipulation incident

HyperLiquid's Hyperliquidity Provider market making vault suffered a $13.5 million loss after an alleged market manipulation incident involving a memecoin called JELLYJELLY. A trader holding nearly $5 million (notional) of the token used a combination of shorts and spot purchases to force HyperLiquid to take on the short position. By forcing the token price up with large spot purchases, HLP suffered an unrealized loss of $13.5 million.

HyperLiquid validators voted to delist the JELLY token. They also evidently overrode the JELLY price provided by the market oracle in an attempt to reduce their losses, leading an unrelated crypto executive to question "Is that even legal?"

Polymarket suffers governance attack as whale manipulates Ukraine bet resolution; refuses refunds

Bets on the Polymarket platform where the outcome is not clear are resolved using an oracle system called UMA, or Universal Market Access. Holders of the UMA token participate in a vote to determine the outcome of challenged market resolutions.

Recently, $7 million was spent in a Polymarket market over whether Ukraine would agree to Trump's proposed mineral deal. Though no mutual agreement was reached, the market resolved to "yes". When it was challenged, a large holder of the UMA token cast a substantial number of yes votes to sway the outcome of the resolution, leaving the outcome in place.

Although Polymarket acknowledged that "This market resolved against the expectations of our users and our clarification" (referring to a Polymarket clarification that the resolution was too early as no mutual agreement was reached), they also refused to issue any refunds, writing that "this wasn't a market failure". "This is an unprecedented situation, and we have been in war rooms all day internally and with the UMA team to make sure this won't happen again. This is not a part of the future we want to build," the team member added.

Abracadabra loses $13 million in "Magic Internet Money"

An attacker using a flash loan attack stole $13 million in the Magic Internet Money token from the Abracadabra project. The attack was enabled by a bug in the platform's smart contracts, and the hacker ultimately made off with around 6,262 ETH.

This is the second time Abracadabra has been exploited, after suffering a $6.5 million theft in January 2024.

Binance acknowledges employee insider trading

Binance announced on Twitter that they had fired an employee after discovering that they had engaged in insider trading. The employee took a large position in a token that he knew would be engaging in a "token generation event", then quickly sold off the tokens after the project announced the event. According to Binance, this allowed him to "realize significant profits".

Binance announced that they had fired the employee, as "This behavior constitutes front-running based on non-public information obtained from his previous role and is a clear breach of company policy." The company became aware of the insider trading after they were alerted by outside parties who submitted tips to the company.

Zoth hacked for nearly $8.3 million, second theft in two weeks

RWA restaking platform Zoth suffered a $8.29 million hack after an attacker gained access to admin privileges that allowed them to modify the platform's smart contracts. The hacker "upgraded" the contract to a malicious version, then withdrew $8.45 million in USD0++, a token issued by the Usual protocol. After swapping the assets into various other tokens, they were left with 4,223 ETH (~$8.29 million).

This is the second Zoth exploit in two weeks, following a $285,000 theft on March 6 by an attacker who took advantage of a bug in one of the platform's smart contracts.

Four.Meme suffers second hack in as many months

After suffering an $183,000 loss to an attack in February, the BNB-based Four.Meme memecoin launchpad has been hacked again, this time for around $130,000. Four.Meme aims to be BNB's version of pump.fun, the popular Solana-based memecoin platform.

Four.Meme acknowledged the latest theft on Twitter, writing that they intended to reimburse users who lost money.

Zoth RWA restaking platform hacked

Zoth, a restaking platform for "real world assets" (or RWAs), was hacked for around $285,000 when an exploiter discovered a bug in the platform's collateral calculations. This allowed them to mint ZeUSD, the platform's stablecoin token, without depositing sufficient collateral.

1inch loses $5 million to smart contract bug

An attacker exploited a smart contract belonging to the 1inch DEX aggregator, stealing $5 million in the USDC stablecoin and wETH. According to the platform, the vulnerability existed in "smart contracts using the obsolete Fusion v1 implementation", and the stolen funds belonged to resolvers (that is, entities that fulfill 1inch orders) rather than users.

Wemix Foundation bridge hacked for $6.2 million

The Wemix Foundation, which runs the blockchain gaming platform WEMIX, suffered a $6.2 million hack of their blockchain bridge. Although the hack occurred on February 28, the company did not disclose the theft until four days after the incident, leading some to accuse Wemix of attempting to cover up the hack. Wemix has denied those allegations, claiming that the delay was in hopes of preventing market panic, and to ensure they had time to patch any security vulnerabilities before publicly disclosing a breach.

Founder of the Mask Network loses more than $4 million to a wallet hack

Suji Yan, the founder of the Mask Network, suffered the loss of more than $4 million in various cryptocurrency assets to an apparent wallet hack. According to Yan, the theft happened on his birthday while he was at a party. "[E]ither the private key was leaked same day as my birthday and hacker manual[ly transferred assets] out or it might be an offline attack. I was in a private gathering with dozen friends and my phone was away for some minutes when I using the restroom etc."

Almost $50 million stolen from Infini "stablecoin neobank"

Around $49.5 million in the USDC stablecoin was stolen from the Infini crypto-focused "stablecoin neobank", a fintech company that promises "financial freedom" by "democratizing banking" and "redefining the future of digital finance".

Infini experienced a different form of "financial freedom" when attackers liberated almost $50 million from the company after a thief with access to a wallet with admin rights drained tokens, then swapped them for the DAI stablecoin, which unlike USDC cannot be frozen by its issuer.

The attack came only a day after a celebratory tweet from the company in which it had announced that they had achieved $50 million in total value locked, suggesting that the theft affected substantially all of the assets on the platform. Despite this, they have claimed that transactions on the platform are unaffected, and when someone asked how that was possible, they simply replied: "We've got solid runway to operate. No worries."

Infini attempted to contact the thief via on-chain message, threatening that they had "gathered critical IP and device information" about them, and asking them to return 80% of the funds in exchange for a promise that Infini "will cease further tracking or analysis, and you will not face accountability". However, Infini's 48-hour deadline has come and gone without any reply.

$1.5 billion taken from Bybit crypto exchange

In what is looking like largest ever theft from a cryptocurrency exchange, attackers took control of a hot wallet belonging to the Bybit cryptocurrency exchange and moved a massive amount of ETH-based tokens amounting to approximately $1.5 billion in notional value (though it should be noted that that quantity of stolen tokens could not be quickly cashed out for that many dollars without affecting the ETH price).

Bybit CEO Ben Zhou confirmed the attack on Twitter, writing that an attacker used an advanced phishing technique to take control of the hot wallet. Zhou also promised "Bybit is Solvent even if this hack loss is not recovered, all of clients assets are 1 to 1 backed, we can cover the loss."

Around 9,000 wallets used with Cardex fantasy trading card game compromised

Around $400,000 in ETH was stolen from around 9,000 wallets on the Abstract layer-2 network, which is built by the same company that makes the Pudgy Penguins NFTs. It appears that the affected wallets had all been used to play Cardex, a fantasy trading card game that had launched only a week prior.

Attackers compromised a private key belonging to the game's creators, which allowed them to drain wallets that still had an active session with the game.

Argentinian president Javier Milei promotes memecoin that then crashes 95% in apparent $100 million+ rug pull

Portrait of Javier MileiPortrait of Javier Milei (attribution)
A tweet from Argentina's president Javier Milei promoted a memecoin called Libra, which he described as a "private project [that] will [be] dedicated to encouraging the growth of the Argentine economy by funding small Argentine businesses and startups". The token quickly soared in price as traders poured in.

However, within hours of the launch, insiders began selling off their holdings of the token. The token had been highly concentrated among insiders, with around 82% of the token held in a small cluster of apparently insider addresses. Those insiders cashed out around $107 million, crashing the token price by around 95%.

After the crash, Milei deleted his tweet promoting the project. He later claimed he was "not aware of the details of the project and after having become aware of it I decided not to continue spreading the word (that is why I deleted the tweet)."

zkLend hacked for around $9.5 million

The Starknet-based lending platform zkLend was exploited for around $9.5 million. zkLend paused the protocol after the attack was discovered, and began working with various crypto security groups to try to trace the stolen funds and identify the thief. zkLend also sent a message to the attacker, offering a 10% "bounty" and a "release from any and all liability" if they returned 90% of the funds. As of twelve hours after the hack, no reply had been made.

Trader accidentally sends 2,000 SOL to bankrupt FTX

A former FTX customer made an expensive mistake in October 2023 when he transferred 2,000 SOL (~$64,000 at the time, almost $400,000 today) to an old FTX account, about a year after the company went bankrupt. Unlike you might expect with an attempt to wire traditional funds to a bank account that's been closed, the funds didn't bounce back. Instead, they've been sitting around under control of the FTX bankruptcy estate, requiring the former customer to seek a court order to get his funds back.

All in all, this customer is actually pretty lucky as far as erroneous transfers go. FTX's bankruptcy team still has access to FTX wallets, and are still actively working on recovering and disbursing assets to creditors. In some cases in the crypto world, erroneous transfers are lost forever.