1513 hack event(s)
Description of the event: According to the BBC, a scam called iEarn Bot has affected thousands of victims in several countries. In the scam, victims were persuaded to sign up for an "AI intelligent quantitative trading robot" called iEarn Bot, which appeared to successfully trade cryptocurrencies on their behalf. However, after some time, the victims realize that they are unable to withdraw their due earnings nor withdraw the funds they invested. iEarn Bot claims to be an American company, despite its website being riddled with misinformation. The man identified as the company's founder told the BBC he had nothing to do with the scheme, with companies and institutions listed as "strategic partners" saying they had no such partnerships. The BBC uncovered a cryptocurrency wallet that received payments from around 13,000 other people totaling close to $1.3 million.
Amount of loss: $ 1,300,000 Attack method: Scam
Description of the event: Poolz Finance's LockedDeal contract was hacked and lost about $500,000. The attacker called the vulnerable function CreateMassPools in the LockedDeal contract, and triggered an integer overflow vulnerability in the parameter _StartAmount. In addition to obtaining a large number of poolz tokens, the attacker also obtained other tokens.
Amount of loss: $ 500,000 Attack method: Contract Vulnerability
Description of the event: Yearn Finance tweeted: “While there is no direct exposure to Euler, some vaults are indirectly exposed to the hack. Vaults using the Idle and Angle strategies have a combined exposure of $1.38 million on yvUSDT and yvUSDC. The developers are currently actively working on the affected protocol, any remaining bad debt will be borne by the Yearn Treasury, and all vaults will remain open and fully operational for users as usual." On May 3, Yearn Finance tweeted that all funds impacted by the march Euler hack have now been recovered. The affected vaults were yvUSDC & yvUSDT, with these strategies having indirect exposure: Idle Finance v4 [Best yield] and Angle Standard LP.
Amount of loss: $ 1,380,000 Attack method: Affected by Euler Finance Attack
Description of the event: The DeFi protocol Idle Finance tweeted that after investigation, the estimated exposure of the Euler Finance vulnerability to the protocol Yield Tranches was $5.6628 million, and the estimated exposure of Best Yield vaults was about $5.3271 million, for a total of about $10.99 million.
Amount of loss: $ 10,990,000 Attack method: Affected by Euler Finance Attack
Description of the event: Yield Protocol, a fixed-rate lending agreement, posted an update on Twitter saying: "All collateral deposited by borrowers on Yield Protocol appears to be safe. Collateral is not deposited into Euler, but is kept in Yield Protocol. Euler hack Affected our mainnet liquidity pool. The Yield liquidity pool holds two assets: Euler eTokens and Yield fyTokens. We do not yet have exact figures for the value of eTokens held prior to the attack, but believe the total value is less than $1.5 million. " On April 25, Yield Protocol tweeted that "we have successfully claimed the recovered funds from Euler. The funds are being held in the timelock. We are now taking the steps to restart Yield Protocol and to enable withdraws. We expect this complicated process to take several weeks to complete."
Amount of loss: $ 1,500,000 Attack method: Affected by Euler Finance Attack
Description of the event: Harvest said that USDC, USDT, and WETH Vault were affected because of the use of Idle. Currently Harvest has not explained how to deal with it, and reminds users not to interact with these vaults until the problem is resolved.
Amount of loss: - Attack method: Affected by Euler Finance Attack
Description of the event: Sherlock is a DeFi security provider that provides smart contract auditing and insurance services. When Euler first launched, it entered into a $10 million partnership with Sherlock, who was responsible for auditing Euler's smart contracts and providing insurance for Euler. After Euler was attacked, Sherlock has passed a vote to pay Euler $4.5 million.
Amount of loss: $ 4,500,000 Attack method: Affected by Euler Finance Attack
Description of the event: Sense Finance is a fixed-rate lending protocol in which fixed-income assets such as Idle can be traded, which was indirectly affected by the Euler attack.
Amount of loss: - Attack method: Affected by Euler Finance Attack
Description of the event: The DeFi lending protocol Euler Finance was attacked, and the attackers made a profit of about 197 million US dollars. The attacker used flashloans to deposit funds and then leveraged them twice to trigger the liquidation logic, donating the funds to the reserve address and conducting a self-liquidation to collect any remaining assets. Two key factors contributed to the success of the attack: 1. Funds were donated to the reserved address without being subjected to a liquidity check. This created a mechanism that could directly trigger soft liquidation. 2. When the soft liquidation logic was triggered by high leverage, the yield value increased, enabling the liquidator to obtain most of the collateral funds from the liquidated user's account by transferring only a portion of the liabilities to themselves. Given that the value of the collateral funds exceeded the value of the liabilities (which were only partially transferred due to the soft liquidation), the liquidator was able to successfully pass their health factor check (checkLiquidity) and withdraw the obtained funds. On April 4th, Euler Labs tweeted that after a successful negotiation, the attacker has returned all the funds stolen from the agreement on March 13th, because the attacker has returned the funds, the $1 million reward campaign launched by the foundation No new information will be accepted.
Amount of loss: $ 197,000,000 Attack method: Flash Loan Attack
Description of the event: The decentralized exchange Balancer disclosed on Twitter that in the Euler Finance attack, about $11.9 million was sent to Euler from the bbeUSD liquidity pool, accounting for 65% of the liquidity pool TVL, and bbeUSD was also deposited The other 4 liquidity pools: wstETH/bbeUSD, rETH/bbeUSD, TEMPLE/bbeUSD, DOLA/bbeUSD, all other Balancer liquidity pools are safe.
Amount of loss: $ 11,900,000 Attack method: Affected by Euler Finance Attack
Description of the event: Angle Protocol, a decentralized stablecoin protocol, tweeted: "Angle Protocol was affected by the Euler exploit, which deposited 17.6 million USDC into Euler. The protocol has been suspended, the debt ceiling has been set to 0, and the Euler AMO has been closed .are monitoring the situation and will update as soon as they are received.” Angle Protocol stated that before the Euler hack, the total value locked (TVL) of the Angle Core module was about 36 million US dollars, and 17.2 million agEUR had passed through the core. Module casting. In addition, in the agreement are: about 11.6 million US dollars in deposits from standard liquidity providers, about 353,000 US dollars in deposits from hedging agents, and a surplus of about 5.58 million yuan.
Amount of loss: $ 17,600,000 Attack method: Affected by Euler Finance Attack
Description of the event: Inverse Finance, a DeFi lending protocol, tweeted: “Euler attack impacted DOLA-bb-e-USD pool on Balancer. Despite quick action to mitigate 90% of the impact, DOLA Fed suffered up to 86% for this pool. million in losses, excluding rewards points. Will be working with Balancer to recover the remaining funds.”
Amount of loss: $ 860,000 Attack method: Affected by Euler Finance Attack
Description of the event: SwissBorg is a crypto asset management platform that is regulated and licensed in Switzerland, France and Estonia. It has its own SwissBorg app and can earn money through this mobile wallet. SwissBorg stated that the ETH and USDT in the Earn strategy suffered partial losses, including 1617.23 ETH and about 1.69 million USDT, accounting for 2.27% and 29.52% of the subscription funds respectively. SwissBorg will bear all losses.
Amount of loss: $ 4,500,000 Attack method: Affected by Euler Finance Attack
Description of the event: Opyn built the first decentralized option protocol, developed the perpetual option Opyn Squeeth, and built a variety of income strategies on Suqeeth. This time Opyn is affected by the Zen Bull strategy, which combines the Crab strategy and ETH leveraged long positions, and is suitable for low-volatility markets where ETH prices are on an upward trend. Since this strategy requires mortgage assets to buy ETH through leverage, it may be a mortgage loan in Euler, resulting in losses. Opyn has not announced the amount of the loss and how it will be dealt with.
Amount of loss: - Attack method: Affected by Euler Finance Attack
Description of the event: The SUCKR project on the Aptos chain is suspected of being a rug pull. The hacker called the mint_SUCKR (admin privilege function) function to mint a large number of SUCKR tokens and exchange them for USDT. The price of SUCKR tokens plummeted by 9% 249h.
Amount of loss: - Attack method: Rug Pull
Description of the event: Hedera tweeted to disclose the details of the attack. The attacker attacked the smart contract service code of the Hedera main network and transferred the Hedera Token Service tokens held by some user accounts to their own accounts. The attackers targeted accounts used as liquidity pools on multiple DEXs migrated to use the Hedera Token Service using Uniswap V2-derived contract generations, including Pangolin Hedera, SaucerSwap, and HeliSwap. When attackers moved tokens obtained through the attack to a Hashport Network bridge, bridge operators detected the activity and acted quickly to disable it. To prevent attackers from stealing more tokens, Hedera shut down the mainnet proxy, which removes user access to the mainnet.
Amount of loss: $ 570,000 Attack method: Contract Vulnerability
Description of the event: Tender.fi is suspected of being attacked by white hat hackers and lost $1.59 million. Hackers used Tender.fi’s misconfigured oracles to borrow $1.59 million worth of crypto assets with just $70 worth of GMX tokens as collateral. On March 8, on-chain data showed that the hackers who attacked the Arbitrum ecological lending protocol Tender.fi had returned their funds, and the Tender.fi team agreed to pay the hackers 62 ETH ($96,500) as a bounty.
Amount of loss: $ 1,590,000 Attack method: Oracle Attack
Description of the event: When PeopleDAO’s community treasury multi-signature wallet on the digital asset management platform Safe (formerly Gnosis Safe) distributed monthly contributor rewards on March 6, 76 ETH (approximately $120,000) were stolen by hackers through social engineering attacks. This event has nothing to do with the PEOPLE token contract. PeopleDAO collects monthly contributor reward information through Google Form. The person in charge of accounting mistakenly shared a link with editing permissions in the Discord public channel. Payments to your own address and set them to be invisible. Due to the malicious concealment, the team leader did not find it during the review. After downloading the csv file with insertef data, it was submitted to Safe's CSV Airdrop tool for reward distribution. With the assistance of SlowMist and ZachXBT, the team found that the attacked funds had been deposited in two exchanges, HitBTC and Binance, and contacted the two exchanges.
Amount of loss: 76 ETH Attack method: Permission Stolen
Description of the event: Arbitrum ecological DEX ArbiSwap is suspected of Rug Pull. ArbiSwap deployers minted 1 trillion ARBI before Rug Pull, and then converted ARBI into USDC, which caused a sharp drop in ARBI in the USDC/ARBI transaction pair. In the next block, the robot passed USDC to ARBI then traded ETH for spatial arbitrage, making a profit of 68.47 ETH. ArbiSwap has transferred 84 ETH to the Ethereum mainnet and sent it to TornadoCash.
Amount of loss: 84 ETH Attack method: Rug Pull
Description of the event: Algorand ecological wallet MyAlgo issued a reminder on Twitter that the hack occurred more than a week ago, and no other actions have taken place since then. The attacked users all had large amounts of funds on their accounts and used mnemonic wallets with keys stored in the browser. ZachXBT, an on-chain data analyst, tweeted: “Due to the attack on MyAlgo, Algorand’s ecological wallet, from February 19th to 21st, more than $9.2 million in assets (19.5 million ALGOs, 3.5 million USDCs, etc.) may have been stolen on Algorand. ChangeNow shared that they were able to freeze $1.5 million.”
Amount of loss: $ 9,200,000 Attack method: Mnemonic Vulnerability