DeFi hacks [history]

[bbc.reporter]

@cryptoaddictchie. Many of them are comedies. Look at the list.

Also, I am not telling everyone that the concept of Defi is comedy. I am only telling everyone that the implementations of Defi are weak, buggy and exploitable. Is this the future of finance?


In any case, everyone should also remember that Defi needs a centralized organization to act as an oracle. This is the same type of trust that you are putting on financial institutions and companies and without the government to protect you and make the people behind the Defi project accountable.

This is a very bad situation for the user.

[moderator's note: consecutive posts merged]

[1714027552]

1714027552

[1714027552]

1714027552

[1714027552]

1714027552

[1714027552]

1714027552

[zasad@]

Soft Yearn (SYFI)
https://cointelegraph.com/news/jackpot-user-turns-200-into-250k-thanks-to-a-buggy-defi-protocol
"An anonymous user managed to net a profit of $250k from a $200 outlay due to a flaw in a DeFi protocol clone’s rebase code.
An anonymous user has revealed how he made $250k in profits from a minor investment in a cloned version of Yearn.finance called Soft Yearn (SYFI)."
https://twitter.com/A_mplify/status/1302852245059330048

[Bossfidelity]

Defi hacks is gaining more popularity over time and it feels like the more we hear of hacks and dumps, the more Defi projects that are being established and pumped. I'm personally scared of investing in Defi projects however lucrative they may be, due to the fear of losses which may arise as Defi seems like a bubble
to me.

[kolap]

What about that Sushi DiFi hack, or I would say scam?

[princecharles]

The hacks of Defi projects is the new normal. Most times we see Defi projects as a gold mine, but in real fact its a risk trap that has ensnared many. The prevalence of the hacks on Defi projects should be an indicator of the weakness of the projects and that should be taking into consideration when one making investment decisions.

[Yaunfitda]

Maybe you need to update it with the latest bZx hacked?



https://twitter.com/MarcThalen/status/1305354469354303488

You can also read more about the incident here: https://bzx.network/blog/incident

[wanted sliter]

The majority of hacks happen on the Ethereum platform. Is it the programmer's fault or the platform?
I am waiting for a hack on the Tronix platform.
Recently the hacks are related to the Rebased token bug. It happens on projects with anonymous teams.

[Malam90]

Thanks! It is very important to give people real information. People think that decentralized finances do not have any risks! But it is absolutely vice versa. It is a new industry, new code, no one tested it for a long time, so be careful and invest only what you can afford.

Right, many people think it is risk free but it is also risky either from hackers or price dump. Price is not a factor but security is must concern here and from this useful post, it is clear that DeFi projects aren't free from risky. As it is new system, new codes should be developed regularly to be more secured otherwise it will be cause of damage to the investors.

[zasad@]

https://www.theblockcrypto.com/post/77656/defi-protocol-bzx-attacked-lost-8-million-faulty-code
DeFi protocol bZx attacked once again, lost $8 million due to a faulty code

"Quick Take
DeFi lending protocol bZx was attacked once again last night and lost $8 million due to a faulty code.
bZx co-founder Kyle Kistner told The Block that “it’s difficult to say” how this “critical” bug went unidentified by the protocol’s two audit firms Peckshield and Certik."

iToken Duplication Incident Report
https://bzx.network/blog/incident

[bbc.reporter]

@zasad@. bZx was attacked 3 times according to an article from Cryptoslate cryptocoin news outlet. This forces you question the qualifications of the development teams behind those Defi projects. Did they get a coding degree from codecademy.com hehehe?

[cryptomaniac_xxx]

@zasad@. bZx was attacked 3 times according to an article from Cryptoslate cryptocoin news outlet. This forces you question the qualifications of the development teams behind those Defi projects. Did they get a coding degree from codecademy.com hehehe?

The thing is that it has been audited by a third party, but didn't capture the bugs itself. So obviously, the blame should be on both the developers and that independent 3rd party. Although my take is that it's really hard to do simulation or create all the test cases because this is fairly new 'technology'.

[zasad@]

https://twitter.com/bZxHQ/status/1305496675474006017
"We are relieved to announce that the missing funds are now restored. More information will follow.

Stay tuned!"

The stolen funds have been returned.

According to rumors, the hacker was found because he sent money from his wallets to centralized exchanges. His identity has been established.

[bbc.reporter]

@zasad@. Someone should teach the hacker about cryptonote coins hehe.

In any case, this is not a Defi hack article, however, this is also very questionable. It promises that its token's price floor only rises because of the magic of their taxation event.

I reckon paycoin had also a similar promise. The scam did not end very well for them.


Price floor: The price floor increases with every taxation event. This is the lowest possible price the contract will exchange TRIB for mUSD. The mUSD is sent to mStable’s saving contract where it continuously generates interest. As more and more sellers and buyers transact with the protocol, the price floor perpetually moves up. As long as there is buying and selling to the contract, it is impossible for the price floor not to go up over time. While many tokens out there can (and probably will) go to zero, that will be impossible with TRIB — it will have interest bearing capital permanently locked into the protocol.

Source https://medium.com/@defisatoshi2.0/introducing-a-new-paradigm-in-defi-the-pooled-interest-savings-token-171e02691ab9

[Zazzu]

please add UNI leakage from metamask wallets , I don't think metamask is a right place to keep money, that is not the first time such a thing happens with metamask , I really don't like it , I would rather trust wallet .

[maxreish]

See? There's a lot more coming on the list. It just indicates that DEFI hype projects were being targetted by the scammers. Thus, many investors were already been tricked with this hype. I'm not saying "all defi" but we can just count few of them that are really created for financial decentralized protocols for the enhancement of system and to sustain the sincere innovation.

[giammangiato]

I can definitely say that DEFI looks more scam than a good project. This is because behind some projects there aren't good teams, the team makes the 80% of the value of the coin, after there is the project. There are good projects with bad teams that will go only in one direction, down

[zasad@]

https://decrypt.co/43203/hackers-drain-15-million-from-unreleased-yearn-finance-project
Hackers Drain $15 Million From ‘Unreleased’ Yearn Finance Project
"A smart contract vulnerability allowed hackers to mint unlimited tokens and sell those for millions of dollars—before returning half the funds to Yearn founder Andre Cronje.

In brief
Hackers targeted a smart contract vulnerability in an upcoming project by Yearn founder Andre Cronje.
They managed to steal over $15 million; but returned $8 million to a wallet owned by Cronje.
The "test in prod" approach proved costly, as Cronje alleged received threats after the hack. "

[bbc.reporter]

@zasad@. The skeptical me thinks that this is the beginning of the Defi exit scams. He tweeted about his not completed and unaudited smart contract and then suddenly from his deployer account, an attacker deposited $8 million?

[zasad@]

I try to keep track of all defi hacks in this thread. Considering that this topic has become popular in 2020, we can conclude that the number of hacks is not so much,
the amount of stolen funds is much less than the centralized exchanges lose.

Fresh good news
$10 Million Ethereum Vulnerability Patched by Whitehat Hacker
https://fullycrypto.com/10-million-ethereum-vulnerability-patched-by-whitehat-hacker

[AmoreJaz]

@zasad@. The skeptical me thinks that this is the beginning of the Defi exit scams. He tweeted about his not completed and unaudited smart contract and then suddenly from his deployer account, an attacker deposited $8 million?

can we say some of them are inside job? and i do agree most of these defis will one by one disappear in no time. as they collect their share from the market, the people behind the project are thinking of ways how to get away from their scheme.
 and ive seen that some hacks are due to the bug in their system. i believe a lot of these DeFis are not yet ready to deploy their network, however, owed to the ambitious goal of taking advantage of the hype, they situated themselves to vulnerability attack. guess, we will be seeing more projects in the list. or is there a list already for all the defi exit scams?