DeFi hacks [history]

[zasad@]

john1010,this is the price of freedom.
___
https://beincrypto.com/gamee-loses-millions-to-hack/
How This Crypto Gaming Project Lost $7 Million to Hackers
Gamee, a subsidiary of Animoca Brands, lost $7 million in a hacking attack involving unauthorized access to its token contracts.
The hackers stole 600 million GMEE tokens, converted them into Ethereum and Polygon, causing a 45% drop in GMEE's price.
In response, Gamee transferred token contracts ownership to a secure address, halted liquidity provisioning, and initiated legal proceedings.

[safar1980]

Sky Mavis Co-Founder Jeffrey Zirlin’s wallets hacked for $9.7 million in ETH
Zirlin wrote on X that he had a “tough morning” as two of his addresses were compromised.

Jeffrey Zirlin, co-founder of Sky Mavis that created the Axie Infinity game, said that two of his wallets were hacked on Friday morning Asia time and that Ronin was not affected, according to his X post.

Blockchain security firm PeckShield identified that a “whale wallet” had been compromised with about 3,248 Ether, worth around $9.7 million, withdrawn from the Ronin Bridge and moved to crypto mixer Tornado Cash.

“The attack is limited to my personal accounts, and has nothing to do with validation or operations of the Ronin chain,” Zirlin said on X. “Additionally, the leaked keys have nothing to do with Sky Mavis operations.”

[zasad@]

https://cointelegraph.com/news/microstrategy-x-account-hacked-phishing-scam
"MicroStrategy’s X account hacked, shilling Ethereum token phishing scam
Hackers took over the official MicroStrategy X account, posting a series of malicious links to a fake airdrop for a so-called Ethereum-based MSTR token.
Scam Sniffer said just one user had lost over $420,000 to the phishing scam at approximately 12:43 am UTC, only several minutes after the first malicious link was posted to MicroStrategy’s account on X. "

[FP91G]

@SenecaUSD exploited for 1,900 $ETH (worth ~$6.5M).
The attacker used constructed calldata parameters to call transferfrom and transfer tokens that were approved to the project's contracts to the attacker's address.
The stolen funds are now held across 3 addresses.
Revoke approvals🔽
https://twitter.com/BeosinAlert/status/1763024503452611038


Dear Whitehat,
Please return the funds to the following Ethereum wallet address: 0xb7aF0Aa318706D94469d8d851015F9Aa12D9c53a
We are collaborating with third-party security providers and law enforcement to trace the funds and identify recipient wallets. Acting promptly is crucial, so we kindly request that you return the funds as soon as possible to avoid any further legal action.
A 20% bounty may be kept as per whitehat efforts.
https://twitter.com/SenecaUSD/status/1762999045109248461



We're happy to see 80% of funds have been returned.
Transaction link: https://etherscan.io/address/0xb7aF0Aa318706D94469d8d851015F9Aa12D9c53a
The exploit involved assets held in users' wallets. The exploit didn't involve funds directly deposited into Seneca (Seneca's TVL).
The recovery of funds through a whitehat request was an extremely optimistic scenario.
It's important to note that Seneca's Chamber contract was audited prior to deployment (@HalbornSecurity).
https://twitter.com/SenecaUSD/status/1763181438113865960

[zasad@]

https://unchainedcrypto.com/ordizk-team-allegedly-steals-1-4-million-in-exit-scam/
OrdiZK Team Allegedly Steals $1.4 Million in Exit Scam
"The team behind cross-chain bridging protocol OrdiZK appear to have stolen $1.4 million worth of ether from users, after allegedly draining tokens from the project contract and deleting its website and social media accounts."

[FP91G]

WOOFi Lost $8 Million in Hack on Its Arbitrum Lending Market

"WOOFi, a decentralized exchange, suffered significant financial losses due to an exploit in its Arbitrum lending market, as revealed by the company on Wednesday.

The exploit, identified by several blockchain security firms, including PeckShield, Hypernative, and Chainalysis, involved flash loan attacks targeting WOOFi Swap on Arbitrum around 15:49 UTC on March 5.
In response, WOOFi swiftly halted the affected contracts at approximately 16:02 UTC and initiated an investigation revealed in a report detailing the incident, which was subsequently released on March 6.

The hacker manipulated the sPMM algorithm, which is responsible for setting prices on Arbitrum-based WOOFiSwaps. This manipulation occurred after borrowing 7.7 million WOO tokens and “some other assets.”

The company stated, “At this point WOOFi’s sPMM incorrectly adjusted WOO to an extreme price which was close to zero, and the exploiter then swapped out 10M WOO in the same transaction with almost no cost. The exploiter repeated this attack 3 times within a very short period of time, which netted about $8.75m in profits after returning the flash loans.”"

https://www.cryptotimes.io/2024/03/06/woofi-lost-8-million-in-hack-on-its-arbitrum-lending-market/

[FP91G]

Binance-Incubated UGC Platform NFPrompt Discloses Significant Losses from Latest Hack
NFPrompt (Non-Fungible Prompt), an AI-powered User Generated Content (UGC) Platform, recently disclosed significant losses resulting from a hack. According to a post on X, NFPrompt revealed that it had fallen victim to cyber intrusion, resulting in the loss of funds from its platform, including a part of NFP treasury and ecosystem fund.
https://www.coinspeaker.com/nfprompt-losses-latest-hack/

[zasad@]

https://twitter.com/Cointelegraph/status/1770933644242169997
"The SSS_HQ token faced a near-total value loss after a double-spending flaw was exploited, despite efforts to save funds."

https://twitter.com/Cointelegraph/status/1770941171411386475
"According to @CertiK, this glitch was rooted in the contracts’ _update() function, which failed to accurately update token balances under specific conditions, enabling users to double their $SSS token balance by transferring it to themselves."

[zasad@]

https://www.theblock.co/post/284883/web3-gaming-platform-munchables-loses-62-5-million-in-exploit-zachxbt
Web3 gaming platform Munchables loses $62.5 million in exploit: ZachXBT
"Munchables, a web3 gaming platform based on the Ethereum Layer 2 Blast, lost $62.5 million in one of the biggest exploits of the year.
The exploiter’s wallet address contained nearly 17,411 ETH, crypto sleuth ZachXBT found.
Munchables reported that the platform had been compromised on the social media platform X. "

[FP91G]

Prisma Finance Hacked; Hacker Demands Apology and Offers to Return $11M

Following a hack of Prisma Finance that caused an $11 million loot from this prominent liquid staking protocol, a hacker in the decentralized finance (defi) division has made some stunning proposals. This person called themselves to be white-hat hackers since they are good ethical hackers who try to find bugs and fix them. Under certain conditions, the money they stole can be returned according to this incident that took place on March 28.

https://www.msn.com/en-us/money/technology/prisma-finance-hacked-hacker-demands-apology-and-offers-to-return-11m/ar-BB1kOp7O

[zasad@]

https://www.msn.com/en-us/money/companies/prosecutors-rest-case-in-mango-markets-fraud-trial/ar-BB1lxgoP
"The government on Friday rested in its case against cryptocurrency trader Avraham Eisenberg, who is facing fraud charges.

Driving the news: Prosecutors presented very strong arguments that the defendant had a good idea he was committing a crime over a year ago, when he managed to extract over $100 million from Mango Markets.

Why it matters: In a fraud case, the government has to not only show that the defendant committed a crime, but that they were aware that what they were doing was against the law.

Catch up fast: Eisenberg is on trial in Federal Court in Manhattan for engaging in a trade where he was able to withdraw all the capital on Solana-based Mango Markets on October 11, 2022, using a derivate of the mango (MNGO) token as collateral.

After inflating the token with strategic purchases on various exchanges, he used the inflated value of a MNGO derivative as collateral to borrow all the available deposits on the platform, over $100 million worth.
Then he withdrew those funds to a wallet he controlled, and let his loan default."

https://www.sec.gov/news/press-release/2023-13
SEC Charges Avraham Eisenberg with Manipulating Mango Markets’ “Governance Token” to Steal $116 Million of Crypto Assets

[FP91G]

Mango Markets Exploiter Avi Eisenberg Found Guilty of Fraud and Manipulation
Eisenberg faces up to 20 years in prison for his $110 million heist.
A Manhattan jury has found crypto trader Avi Eisenberg guilty of fraud and market manipulation for his $110 million heist from decentralized finance protocol Mango Markets in October 2022.
Eisenberg was arrested in Puerto Rico in December 2022 and charged with commodities fraud, commodities manipulation, and wire fraud for the scheme. He will be sentenced on July 29 by New York District Court Judge Arun Subramanian. Eisenberg faces up to 20 years in federal prison for his crimes.
“This ground-breaking prosecution epitomizes this office’s ability to employ innovative methods and cutting-edge law enforcement tools to continue to protect all financial markets," said Damian Williams, U.S. Attorney for the Southern District of New York, in a Thursday press statement. "The career prosecutors of this office continue their expertise in prosecuting financial fraud, one of our core priorities, and would-be financial criminals should think twice before daring to engage in illicit conduct on our watch.”
https://www.coindesk.com/policy/2024/04/18/mango-markets-exploiter-avi-eisenberg-found-guilty-of-fraud-and-manipulation/

[zasad@]

https://cointelegraph.com/news/pike-finance-exploited-1-6-million-second-exploit-3-days

Pike Finance exploited for $1.6M in second incident in 3 days

"Pike Finance has been exploited, resulting in the loss of $1.68 million worth of digital assets. The incident marks the protocol’s second exploit in three days.

Decentralized finance (DeFi) lending protocol Pike Finance suffered a $1.68 million exploit across the Ethereum, Arbitrum and Optimism chains on April 30, according to a report from on-chain analytics firm CertiK, shared with Cointelegraph.

The attacker used a vulnerability in Pike Finance’s smart contract to change the output address, draining the contract of over $1.4 million worth of Ether , $150,000 worth of Optimism (OP) tokens and over $100,000 worth of Arbitrum (ARB) tokens, according to CertiK."

[zasad@]

https://twitter.com/peckshieldalert/status/1786447590042779855
"#PeckShieldAlert #Phishing A whale 0x1E22...8FD5 lost ~1,155 $WBTC (worth ~$71 million) after falling victim to address poisoning.
The phisher has swapped the stolen $WBTC for ~23K $ETH & transferred them out"


https://twitter.com/PeckShieldAlert/status/1788880553653002311
"#PeckShieldAlert ~50% of the stolen funds (~11,446.87 $ETH worth ~$34.7m) has been returned to the victim's address"

[zasad@]

https://www.coindesk.com/markets/2024/05/21/gala-games-hacker-returns-23m-in-eth-founder-proposes-buy-and-burn/
"Gala Games Hacker Returns $23M in ETH; Founder Proposes 'Buy and Burn'
Gala investor DWF Labs also said that it had purchased 28 million GALA tokens "to alleviate market selling pressures."

Hacker returned $23 million worth of ether to Gala Games after Monday's exploit.
CEO Eric Schiermeyer said "will probably buy and burn."
Gala investor DWF Labs also said that it had purchased 28 million GALA tokens."