1722 hack event(s)
Description of the event: On the evening of May 18, the BSC-based DeFi lending platform Venus token XVS was doubled by the giant whale. After that, XVS was used as collateral to borrow and transfer BTC and ETH worth hundreds of millions of dollars. Since then, the price of collateral XVS is large. It fell and faced liquidation, but due to insufficient liquidity in the XVS market, the system failed to liquidate in time, resulting in a huge shortfall of hundreds of millions of dollars in Venus. On the 30th, Venus officially released an article that disclosed the process and results of the incident. The survey showed that the liquidator made a profit of about 20 million U.S. dollars, and the seller made a profit of about 55 million U.S. dollars; the "scalper" made a profit of about 2 million U.S. dollars; the 0xef044 address account had a net loss of about 66 million U.S. dollars. Secondly, its address attribution is based on the Swipe escrow address used on Binance, so there is no insider trading. The agreement lost approximately $77 million due to market fluctuations. VGP will recover approximately US$77 million from the distribution fund, and formulate a community recovery plan for XVS holders and others in the form of airdrops from the distribution fund and agreement income.
Amount of loss: $ 145,000,000 Attack method: Lack of Liquidity
Description of the event: According to an official statement from on-chain options protocol FinNexus, part of FinNexus’ hardware has been attacked by malware, and an unknown hacker infiltrated the FinNexus system and managed to recover the private key of the ownership of the FNX token contract. FNX was minted, transferred or sold in large numbers in a short period of time, involving more than 300 million FNX tokens (about 7 million US dollars) in BSC and Ethereum.
Amount of loss: $ 7,000,000 Attack method: Private Key Leakage
Description of the event: The DeFi protocol bEarnFi stated that on May 16, its bVaults BUSD-Alpaca strategy was attacked, and nearly 10.86 million BUSD in the pool was exhausted. However, the remaining bvault and other pools of the platform are not at risk. At the same time, bEarnFi released a rough compensation plan, which will create a compensation fund, which will consist of the remaining savings funds, development funds, DAO funds, and part of the expenses incurred by the agreement. After that, a snapshot of the balance will be taken to deploy compensation contracts. Affected users will receive an additional 5% of their deposit amount.
Amount of loss: $ 11,000,000 Attack method: Contract Vulnerability
Description of the event: Ishii, an employee of Tokyo Sony Life Insurance Company ("Sony Life"), allegedly misappropriated US$154 million when attempting to transfer funds between the company’s financial accounts. According to court documents, Ishii changed the transfer address of a Sony Life transaction to Silvergate bank account that you control. Ishii later converted funds into more than 3879 bitcoins through Coinbase. The Coinbase set up to automatically transfer all added funds to an offline cryptocurrency cold wallet with the bitcoin address bc1q7rhc02dvhmlfu8smywr9mayhdph85jlpf6paqu. However, on December 1, after cooperating with Japanese law enforcement agencies, the FBI seized 3789.16242937 BTC in Ishii's wallet after obtaining the private key. The Tokyo Metropolitan Police Department arrested the 32-year-old Ishii on the same day and alleged In mid-May, he was charged with a fraudulent remittance of 154 million U.S. dollars.
Amount of loss: - Attack method: Insider Manipulation
Description of the event: According to previous news, starting from 11:28 UTC on May 14th, the flash.sx flash loan smart contract suffered a reentry attack vulnerability, and approximately 1.2 million EOS and 462,000 USDT were stolen. According to official sources, after EOS Nation's Lightning Loan was hacked, the project party initiated a proposal to directly change the hacker's EOS account permissions and return the assets. It is reported that the proposal initiated by the project party changed the hacker address authority to BP, which will be executed after approval.
Amount of loss: $ 11,742,000 Attack method: Reentrancy Attack
Description of the event: The DeFi pledge and liquidity strategy platform xToken was attacked, and the xBNTaBancor pool and the xSNXaBalancer pool were immediately exhausted, causing nearly $25 million in losses. The SlowMist security team analyzed that the two modules that were hacked this time were the xBNTa contract and the xSNXa contract in xToken. The two contracts were subjected to a "counterfeit currency" attack and an oracle manipulation attack.
Amount of loss: $ 25,000,000 Attack method: Oracle Attack
Description of the event: DeFi robo-advisor agreement Rari Capital stated on Twitter that its ETH fund pool had a vulnerability caused by the integration of the Alpha Finance Lab protocol, which was attacked. The rebalancer has now removed all funds from Alpha. The team stated that it is still investigating and evaluating, and a full report will be released in the future. Data shows that about 14 million U.S. dollars of funds were transferred by the attackers. The Alpha Finance team stated that the funds on Alpha Homora are safe. In this attack, the address of Rari Capital had previously attacked Value DeFi on the Binance Smart Chain.
Amount of loss: $ 14,000,000 Attack method: Contract Vulnerability
Description of the event: DeFi protocol ValueDeFi is suspected of being hacked again after being hacked on the 5th. ValueDeFi reminds users in the community, "All non-50/50 transaction pools of the project have been used. Please stop purchasing gvVALUE and vBSWAP until the project team provides a solution." It was subsequently confirmed that more than 3,000 ETH (approximately 10 million U.S. dollars) were lost.
Amount of loss: $ 10,000,000 Attack method: Contract Vulnerability
Description of the event: On May 7, 2021, Colonial Pipeline, the largest oil and gas pipeline operator in the United States, was targeted by a ransomware attack. The ransomware attack involved national critical infrastructure, which caused global shock and widespread concern. Was blackmailed to pay 5 million U.S. dollars worth of Bitcoin. Court documents show that the government recovered 63.7 bitcoins ($2.3 million).
Amount of loss: $ 2,700,000 Attack method: Ransomware
Description of the event: In response to users reporting that the official website of Hpool could not be opened, Hpool officially responded that the front end of the official website was attacked by DDOS.
Amount of loss: - Attack method: DDoS Attack
Description of the event: Value DeFi stated that at 11:22 on May 5th, the attacker reinitialized the fund pool and set the operator role to himself, and _stakeToken was set to HACKEDMONEY. The attacker controlled the pool and called governmentRecoverUnsupported (), which was exhausted. The original pledge token (vBWAP/BUSD LP). Then, the attacker removes 10839.16 vBWAP/BUSD LP and liquidity, and obtains 7342.75 vBSWAP and 205659.22 BUSD. Subsequently, the attacker sells all 7342.75 vBSWAP at 1inch to obtain 8790.77 BNB, and buys BNB and BUSD renBTC through renBridge. Converted to BTC. The attacker made a total of 205,659.22 BUSD and 8,790.77 BNB. The 2802.75 vBSWAP currently in the reserve fund and the 205,659.22 BUSD of the ValueDeFi deployer will be used to compensate all users in the pool. The remaining 4540 vBSWAP can be compensated in the following two ways. The first option is to cast 4540 vBSWAP to immediately compensate all affected users, and the other option is to cast 2270 vBSWAP to immediately compensate, and the rest will be returned to the contract within 3 months. Value DeFi emphasized that only the vStake profit sharing pool of vBSWAP in bsc.valuedefi.io has received the impression, and other fund pools and funds are in a safe state.
Amount of loss: $ 5,817,780 Attack method: Contract Vulnerability
Description of the event: The Mask Network official stated that the contract address of the second round of ITO was attacked by robots, and the address has been officially blacklisted.
Amount of loss: - Attack method: Robot attack
Description of the event: According to the SlowMist Intelligence, the Binance smart chain project Spartan Protocol was hacked and the loss amounted to about 30 million U.S. dollars. The event was due to a flaw in the calculation of liquidity shares in the protocol.
Amount of loss: $ 30,000,000 Attack method: Contract Vulnerability
Description of the event: Fei Labs, the development team of the decentralized stablecoin project Fei Protocol, tweeted that a vulnerability involving the ETH joint curve contract was discovered and disclosed on May 2 and the contract was immediately suspended. The vulnerability has not been exploited and will not affect any users. . This loophole will cause the flash loan market manipulation to exhaust Fei Protocol's Protocol Control Fund (PCV). In addition, Fei Protocol awarded the vulnerability discoverer Alexander Schlindwein a $800,000 TRIBE token reward. Currently, OpenZeppelin and Alexander Schlindwein have assisted in repair review and verification, sending ETH from the joint curve to the reserve stabilizer instead of the ETH-FEI Uniswap pool to eliminate the attack vector, and adding to the pool to prevent malicious arbitrage Other reviews.
Amount of loss: - Attack method: Contract Vulnerability
Description of the event: Hotbit said that it suffered a serious cyber attack on April 29th, which caused a large number of basic services to be paralyzed. At the same time, the attacker tried to hack into Hotbit's wallet, but this behavior was identified and blocked by the risk control system. Since the attacker could not access any cryptocurrency assets, he deleted Hotbit's database. Hotbit is currently checking the authenticity and security of the backup data, and will restore servers and services later. At the same time, Hotbit claimed that the attackers obtained plaintext customer information stored in the database, including mobile phone numbers, email addresses, and encrypted currency asset data. Therefore, it is recommended that users pay attention to prevent phishing attacks.
Amount of loss: - Attack method: Network attacks
Description of the event: A loophole in the BSC ecosystem Uranium Finance resulted in the theft of US$50 million in funds. Research analyst Igor Igamberdiev pointed out an error in the Pair contract in Uranium v2. Due to calculation errors, this was used to withdraw almost all tokens. The balance of these Pair contracts has also been overstated. Igamberdiev believes that the project team made a carpet pull.
Amount of loss: $ 50,000,000 Attack method: Contract Vulnerability
Description of the event: At 00:35 on April 24th, SBF, the co-founder of the FTX exchange, tweeted that the website suffered a small DDOS attack. User funds and core systems will not be affected, only the throughput of API and GUI will be affected.
Amount of loss: - Attack method: DDoS Attack
Description of the event: Six siblings of Turkish exchange Thodex executives and CEO have been formally arrested, a Turkish court said. And Thodex CEO Faruk Fatih Özer disappeared, leaving behind a collapsed exchange with total losses estimated to range from $24 million to $2.5 billion. Faruk was arrested in August more than a year after fleeing Turkey. In September 2023, Faruk and his siblings were sentenced to 11,196 years in prison and will also pay a fine of 135 million lira (approximately $5 million).
Amount of loss: $ 2,500,000,000 Attack method: Scam
Description of the event: Ankitt Gaur, founder and CEO of Layer 2 DeFi lending protocol EasyFi (EASY), said, “On April 19, team members reported that a large number of EASY tokens were transferred from the official EasyFi wallet to the Ethereum network and several unknowns on the Polygon network. Wallet. Someone may have attacked the management key or mnemonic. The hacker successfully obtained the administrator key and transferred $6 million of existing liquid funds in the form of USD/DAI/USDT from the protocol pool, and transferred 298 Ten thousand EASY tokens (approximately 30% of the total supply of EASY tokens, currently valued at 40.9 million U.S. dollars) were transferred to the wallet of the suspected hacker (0x83a2EB63B6Cc296529468Afa85DbDe4A469d8B37)."
Amount of loss: $ 46,900,000 Attack method: Private Key Leakage
Description of the event: Encrypted lending service Celsius has discovered a data breach in one of its third-party service providers, which has exposed the personal information of its customers. According to the email, the hacker gained access to the "third-party email distribution system" used by Celsius. Hackers use this information to send fraudulent emails and text messages to trick them into revealing the private keys of their funds. On April 14, Celsius users started reporting a fraudulent website claiming to be the official Celsius platform. Some users also receive text messages and emails claiming to be Celsius official, can link to the website, and prompt the recipient to enter sensitive information. It is reported that Celsius' competitor BlockFi suffered a similar data breach last spring.
Amount of loss: - Attack method: Information Leakage