Are ICO platforms and DEX hacks really exit scams by the ICO founders?

[bbc.reporter]

Might these hacks be really inside jobs done by the founders of the projects or the decentralized exchanges themselves? There is already a clear indication that close to all those ICOs will end in nothing but wasted effort and money to the naive founders, and millions in the pockets of the scammers.

If these hacks are a form of exit scams then we should see more of them this year and the next hehehe.



The value of Ethereum was down only slightly Monday after hackers made off with roughly $12 million worth of the digital currency in a coordinated attack on Bancor, a decentralized cryptocurrency exchange. At the time of writing, the stolen ether is still at large.

At roughly 00:00 UTC, Bancor was subject to a security breach exposing tens of thousands of ETH coins. ERC-20 tokens NPXS and BNT were also compromised in the attack.

Bancor disclosed the attack early Monday in a post that appeared on Twitter. The attack targeted a wallet used to upgrade some smart contracts on the network, which allowed the perpetrator to steal large sums of ERC-20 tokens in addition to Ethereum.

The monetary breakdown of the attack is as follows:

24,984 ETH (~$12.5 million)
229,356,645 NPXS (~$1 million)
3,200,000 BNT (~$10 million)

NXPS is the native currency of the Pundi X platform. Bancor is the native coin of the Bancor exchange.

Read in full https://hacked.com/ethereum-price-holds-steady-after-bancor-hack-compromises-12-million-eth/

[gabagandalf]

oh, again a big project that has fallen. really sad to read that the hack was so successful. already impressive, how much was stolen. i am sorry to all who have lost their coins and tokens through the hack. 

[bbc.reporter]

News update. There are now some queries if Bancor is really decentralized. If it is then cryptocoins in the exchange should not be stolen because the users hold the private keys. The decentralized exchange also should not be able to freeze any trading or movement of coins, which Bancor can and did.

Bancor is centralized, and maybe the reason why they claim they are decentralized is to prevent their ICO token, BNT, to be classified as an illegal security by the SEC.

Also, the hackers are said to have exploited a backdoor in the exchange that was programmed by the Bancor developers themselves.



Bancor, an Israel-based company runs a ‘decentralised’ exchange called Bancor, ofcourse. In June last year, Bacor became the biggest ICO in terms of raising money. Bancor foundation raised $153 Million in Ether by selling its token BNT. What will Bancor build? A decentralised Exchange.

A year later today, the exchange was hacked and lost about $23.5 Million worth of cryptocurrency.

The exchange said in a statement, “a wallet used to upgrade some smart contracts was compromised”. The attackers withdrew 24984 ETH (~12.5 M USD), PundiX’s NPXS token worth approximately One million USD and BNT, Bancor’s tokens worth approximately 10 M USD.

Bancor has taken its exchange offline while it conducts an investigation. There is no word on when the service will resume.

The fundamental idea behind a decentralised exchange is that the users hold their private keys. Hence, decentralised exchanges don’t get hacked. Bancor has claimed to be a decentralised exchange and strictly speaking it looks like one because user funds remained unaffected in this hack. But there are reasons to categorise it as a centralised exchange which we will get to in a minute.

We have to wait until an official response from Bancor shares more insight. But while we wait, it isn’t a bad idea to glance upon what could be the loopholes that may have led to this hack.

A year ago when Bancor launched, a crypto researcher Udi Wertheimer pointed out the vulnerabilities in the Bancor smart contract in a blogpost. Today, while the real reason for the hack is still under investigation, the vulnerabilities call out on Bancor for being ‘decentralised’.

Read the article https://coincrunch.in/2018/07/10/bancor-hack-is-the-compromised-exchange-truly-decentralised/

Read the warning from last year https://medium.com/unchained-reports/bancor-unchained-all-your-token-are-belong-to-us-d6bb00871e86

[tsaroz]

You are correct about the centralization. A decentralized account cannot be hacked on the side of the exchange only on user side. So it's lying.
Exchanges and founding team hacking themselves don't yield any financial profit as they reinstate user balance(mostly) and the price of coin decreases. They already hold a good portion of coin and have other ways to increase it's price and make profit. Though it can be a publicity stunt to show we'll deliver even if we are hacked.

[bbc.reporter]

@tsaroz. Then the Bancor exchange is open to more regulatory risks and, in time, it will die because it cannot win the competition versus the other exchanges in the long term.

If they are part of the naive who think they are doing something good in the cryptospace, then they will lose money and will have wasted their time and their energy. But I reckon if they are scammers, then the quickest way to get money out for themselves is to exit scam by pretending they were hacked. Also remember that they placed the exploited hidden backdoor on the exchange themselves.

Another platform that has a rumored backdoor placed by their developers is Augur.

[bbc.reporter]

News update. Bancor responded to critics and have aired their view on why the exchange is not decentralized. In a medium post, the founder said this.

So long as the existence and use of emergency control functions are fully transparent to the world, and users have the ability to easily fork networks if they disagree with their governance structures or execution, networks remain decentralized and censorship-resistant — a tremendous leap forward from the systems that dominate our online and offline worlds today.

That does not stop the exchange from being open to abuse, to freeze funds as they see fit or the ban a user from using the exchange. The Medium post also made weak reasons using opensource code, a transparent database and sovereign authentication.

Would those 3 stop my funds from being frozen?