211 hack event(s)
Description of the event: The LSDFi protocol unshETH stated that at around 22:00 on May 31, one of the deployment private keys of the unshETH contract was leaked. For the sake of caution, the official has urgently suspended the withdrawal of unshETH's ETH. According to the security model, unshETH's ETH deposit (TVL up to 35 million US dollars) is protected by multi-signature + time lock and is not at risk.
Amount of loss: $ 23,8000 Attack method: Private Key Leaked
Description of the event: On-chain detective ZachXBT tweeted that a Rug Pull occurred on Pixel Penguin, a charity project created by Hopeexist1, which claimed to raise funds to help him fight cancer. At present, the social accounts of Hopeexist1 and Pixel Penguin have been deleted, and the Pixel Penguin contract is worth only $117,000 (61.686 ETH).
Amount of loss: $ 117,000 Attack method: Rug Pull
Description of the event: Twitter user @ChrisONCT cited on-chain data to expose a suspected scam Meme coin project Waifu AI World (WFAI). The token economics announced by the project stated that 95% of the supply was allocated to LPs. However, shortly after WFAI went online, 4 new wallets spent a total of 14.4 ETH in four transactions to purchase 647 trillion WFAI, accounting for approximately 83.2% of supply (777 trillion). At present, the project party has blacklisted the wallets that purchased 457 trillion WFAI, and now the total supply of WFAI is 320 trillion, which means that 190 trillion tokens are held by insiders, accounting for 60% of the total token supply. And DWF Labs spent about 20 ETH to purchase 624.9 billion WFAI yesterday afternoon; DEXTools trust score changed from extremely low to extremely high within a few hours.
Amount of loss: - Attack method: Scam
Description of the event: Perpetual DEX El Dorado Exchange (EDE) was suspected of being attacked and lost about $580,000. An address has been sending small amounts of funds to Arbitrum's ELP-1 pool and withdrawing large amounts of funds immediately afterwards. According to monitoring, the attacker has returned 334,000 USDC.
Amount of loss: $ 580,000 Attack method: Unknown
Description of the event: The WEEB project was attacked by price manipulation. The hacker used the performUpkeep function in the WEEB token to burn the balance of a large number of WEEB tokens in the pair, thereby increasing the price of WEEB and making a profit of 16 ETH.
Amount of loss: 16 ETH Attack method: Price Manipulation
Description of the event: FLOKI suffered a flash loan attack and lost about $30,000. TX: https://etherscan.io/tx/0x118b7b7c11f9e9bd630ea84ef267b183b34021b667f4a3061f048207d266437a
Amount of loss: $ 30,000 Attack method: Flash Loan Attack
Description of the event: Hakuna Matata ($HAKUNA) Rugged. The scammer initially obtained 2.76 ETH from Orbiter Finance Bridge and added 2 ETH liquidity, then exchanged 4,999T HAKUNA for 17 ETH ($31,683.11), and mortgaged 13.5 ETH to Lido.
Amount of loss: $ 31,683.11 Attack method: Rug Pull
Description of the event: FTX ($HIS) Rugged. The scammer initially obtained 2.76 ETH from Orbiter Finance Bridge and added 2 ETH liquidity, then exchanged 4,999T HIS for 13 ETH ($24,568.11), and mortgaged 11.5 ETH to Lido.
Amount of loss: $ 24,568.11 Attack method: Rug Pull
Description of the event: Freddie ($FREDDIE) has Rugged. The scammer initially obtained 2.96 ETH from Orbiter Finance Bridge and added 2 ETH liquidity, then exchanged 4,999T FREDDIE for 28 ETH ($52,344.4), and mortgaged 22.5 ETH to Lido.
Amount of loss: $ 52,344.4 Attack method: Rug Pull
Description of the event: Derpman ($DMAN) Rugged. The scammer initially obtained 4 ETH from Binance, added 3 ETH to liquidity, then exchanged 1,200T DMAN for 48.55 ETH ($89,611.09), and transferred these ETHs to 0x4d1f…915.
Amount of loss: $ 89,611.09 Attack method: Rug Pull
Description of the event: GeniusMeme ($GNS) has Rugged 33.6 ETH($62,180.81). The scammer initially received 4 ETH from Binance and added 3 ETH to liquidity.
Amount of loss: $ 62,180.81 Attack method: Rug Pull
Description of the event: Pepega ($PEPG) has Rugged 30 ETH ($55,609.2). The scammer initially received 3.58 ETH from Binance and added 2.8 ETH to liquidity.
Amount of loss: $ 55,609.2 Attack method: Rug Pull
Description of the event: MChainCapital suffered a flash loan attack and lost about $18,871. TX: https://etherscan.io/tx/0xf72f1d10fc6923f87279ce6c0aef46e372c6652a696f280b0465a301a92f2e26
Amount of loss: $ 18,871 Attack method: Flash Loan Attack
Description of the event: YODA coin project happened Rug Pull, YODA token price fell 100%, @yodacoineth_ has deleted his social account/group. Scammers have transferred 68 ETH (~$130,000) to FixedFloat.
Amount of loss: $ 130,000 Attack method: Rug Pull
Description of the event: A Rug Pull on the meme coin project WSB Coin, again involving an address on-chain marked “ZJZ.eth,” dumped most of the WSB team’s supply for $635,000 (334 ETH).
Amount of loss: $ 635,000 Attack method: Rug Pull
Description of the event: Ordinals Finance has been identified as an exit scam project that caused $1 million in losses. The deployer withdraws OFI tokens from the OEBStaking contract, exchanges them for ETH and transfers them to the EOA address (0x34e...25cCF), which in turn transfers 550 ETH (approximately $1 million) to Tornado Cash. All social media accounts and websites of the project have been deleted.
Amount of loss: $ 1,000,000 Attack method: Rug Pull
Description of the event: KyberSwap, a DEX aggregator and liquidity platform, tweeted that they discovered a potential loophole in KyberSwap Elastic, and hoped that liquidity providers could extract liquidity as soon as possible. No user assets have been lost so far.
Amount of loss: - Attack method: Contract Vulnerability
Description of the event: Zksync era mainnet SyncDex project has exited with a rugpull, resulting in over $370,000 USD in losses.
Amount of loss: $370,000 Attack method: Rug Pull
Description of the event: The decentralized revenue aggregation platform Yearn Finance was attacked, and the hackers made more than $10 million in profits. According to the analysis of SlowMist, the reason for this attack is that the attacker used the yUSDT contract to set the fulcrum address by mistake, thereby manipulating the stablecoin reserve balance in the yUSDT contract, and depositing USDT in yUSDT to obtain a large amount of unexpected yUSDT Tokens for profit.
Amount of loss: $ 10,000,000 Attack method: Contract Vulnerability
Description of the event: SUSHI RouteProcessor2 was attacked and lost about 1800 ETH, about $3.34 million. According to the analysis of SlowMist, the root cause is that ProcessRoute does not perform any checks on the route parameters passed in by the user, which leads the attacker to use this problem to construct a malicious route parameter so that the Pool read by the contract is created by the attacker.
Amount of loss: $ 3,340,000 Attack method: Incoming parameters are not checked