Multichain shuts down amidst $130 million suspected hack

Blockchain watchers observed $130 million in various assets flowing out of the Multichain blockchain bridge, questioning whether there had been an exploit. Multichain tweeted, "The team is not sure what happened and is currently investigating," and recommended users stop using the service and revoke contract approvals.

Several hours later, Multichain wrote that they had stopped service, and that "all bridge transactions will be stuck on the source chains. There is no confirmed resume time."

In May, Multichain suffered a bizarre slew of issues, culminating in the project team admitting that their CEO had gone missing and could not be contacted. So far, they have not reported his return.

This is also not the first hack suffered by Multichain. In January 2022, the project, bafflingly, publicly announced a security vulnerability that was affecting their tokens, without first instructing users to safeguard their tokens. Attackers quickly followed the instruction manual provided to them by Multichain, making off with around $3 million in assets.

NFTPerp blows up

A project called NFTPerp was, as the name suggests, a perpetual futures exchange for NFTs, allowing people to take long or short positions against NFTs. It relied on a vAMM — virtual automated market maker — which essentially simulates liquidity without there being any real money in the system. Such a system can be thrown out of whack if there is imbalance in the positions people are taking — for example, if everyone tries to go short on NFTs in a brutal bear market.

So anyway, that's exactly what happened. NFTPerp announced that they would be sunsetting their popular beta project after accruing bad debt.

How they're going about it has been controversial among the successful traders on the platform: essentially, those who were in profit will lose their unrealized gains, while those who had lost money in their trades will have their losses waived. "Nftperp stealing profits from winner [unrealized profit and loss] to backstop losers UPNL is insane to me", wrote one commenter. Another wrote, "If anyone else is considering NFT perps, please have the 'what happens when the illiquid market goes to zero overnight' plans clearly in place from the beginning."

Not to be deterred, the team is already preparing to launch a "v2". May it go as well as their first attempt.

Trader loses $213,000 to phishing scam, blames Twitter

Twitter reply by an account called "@burntteoast", advertising a link to a supposed "Doodles 2" projectDoodles scam (attribution)
Crypto personality LoveMake.eth wrote a Twitter thread about how they fell victim to a phishing scam in which an account appearing to belong to the cofounder of the popular Doodles NFT project advertised a fake project in the replies to a thread by a real cofounder. The Twitter account appeared to be Doodles' cofounder burnttoast, but the handle was actually burntteoast. LoveMake connected their primary wallet, which was immediately drained of 61.5 ETH (~$120,000) and $93,400 in the Tether stablecoin.

LoveMake wrote on Twitter that "I am dyslexic and didn't notice that the Burnt Toast acc was scam. It was very similar to the original & Verified." They appeared to blame Twitter's new verification process, writing, "@Twittersupport can you explain the meaning of the word 'verified'? we're waiting for days every time we change pfp or display name and then I got scammed by verified account with exact the same name and pfp as Doodles founder in million views thread?"

Several days later, they posted a thread again criticizing the prevalence of crypto scammers on Twitter. "I put millions $ into web3 projects, with over 90k$ into Twitter ads. I was rugged many times and finally robbed but not broken. Thanks to twitter the most profitable web3 activity now is a scam. Shouldn't Twitter pay more attention to its own security?"

Angry over the Azuki Elementals fiasco, Azuki holders form a DAO and immediately get exploited

After paying nearly $40 million for a new set of Azuki NFTs, the Azuki community is pissed that they were "dilutive" near-copies of the original Azuki collection. To fight back against the perceived "blatant scamming" by the Azuki creators, holders claiming to have collectively spent millions on Azuki projects formed an Azuki DAO. The DAO created a governance token, $BEAN, which it distributed to Azuki NFT owners. The DAO then embarked on a vote to hire a lawyer, sue Azuki's creator, and demand a refund of the 20,000 ETH (~$38 million) collectively spent on Elementals NFTs.

However, shortly after the DAO was created, the governance token was exploited. Attackers were able to take advantage of a flaw in the smart contract, with two exploiters stealing around 35 ETH (~$69,000). The DAO paused the contract to prevent further thefts.

File this one under "adding insult to injury".

Encryption AI rug pulls for $2 million, developer allegedly blames gambling addiction

A project called "Encryption AI" promised a Telegram bot that would provide a "secure and efficient way to launch tokens". People poured in around $2 million before the developer suddenly withdrew all the funds, crashing the token price by 99%.

The developer reportedly posted a message to Telegram, apologizing for taking the funds. "I must confess that I have fallen into a severe addiction to online gambling and casinos," the developer reportedly wrote. "Despite being only 22 years old, I have struggled to overcome this addiction, and unfortunately, I have lost nearly $300,000 over the past few months, including after the launch of [Encryption AI]."

They added, "Although I cannot guarantee when or if I will be able to make amends and relaunch [Encryption AI], I promise that I will make every effort to become a better person." Oh, well, in that case.

Poly Network exploited again

The name Poly Network may ring a bell, because in August 2021 they were exploited for an (at the time) record-setting $611 million.

Now, it's happened again, and some reports are throwing around even more massive numbers like $42 billion. In reality, the exploiters were able to mint massive quantities of tokens on multiple networks, with their wallet balances showing numbers in the billions. However, complete lack of liquidity for these tokens meant their "billions" are worth substantially less.

According to crypto research firm Beosin, the attackers have so far cashed out around 5,196 ETH (~$10.1 million) in liquid assets. Poly Network suspended services shortly after the attack.

Kraken ordered to turn over user information to U.S. tax investigators

Bad news for wealthy crypto traders on Kraken, who previously might have hoped to evade paying taxes on their past crypto trades. A judge has ordered the exchange to turn over information to the U.S. Internal Revenue Service on users who engaged in at least $20,000 in trades in any year between 2016 and 2020.

Although Kraken argued against the order, describing it as an "unjustified treasure hunt", the judge determined that the IRS was justified in its request, and ordered Kraken to cough up the records. The IRS alleged that although the exchange has more than 4 million users, and has processed $140 billion in trades since its inception in 2011, only 288,330 of those users have filed tax returns.

Huobi patches massive vulnerability after researcher allegedly tries for a year to disclose it

After the Huobi crypto exchange (finally) fixed a massive vulnerability, researcher Aaron Phillips published a blog post explaining what he had found. According to Phillips, two years ago, the exchange accidentally published a file containing Amazon Web Services (AWS) credentials, which could have allowed a bad actor to modify content on their websites and in their CDN, distribute malicious versions of their Android app, access user data and "whale reports" on high-value users, access OTC trade records and user data for OTC traders, and "carry out the largest crypto theft in history". "I had full control over data from almost every aspect of Huobi's business," wrote Phillips.

According to Phillips, it took months before he was able to get in touch with Huobi and convince them to act on the leak. Phillips first notified Huobi of the leak in June 2022, and after repeated efforts to contact the company, the credentials were only revoked in June 2023.

Huobi has tried to downplay the hack, first stating that the user data leak was "on a small scale (4,960 individuals)" and "does not involve sensitive information and does not affect user accounts and fund security". They also claimed the leaked OTC data was test data. "The log shows that only [Phillips] has downloaded, and [Phillips] has also stated that he has deleted. Therefore no leakage is actually caused," they wrote.

According to CoinGecko, Huobi is the seventeenth-largest cryptocurrency exchange by volume.

Cardinal Labs shuts down

A little less than a year after raising $4.4 million in seed funding to build a Solana NFT protocol that allowed for NFT rentals and other such things, Cardinal Labs has announced they're shutting down.

"Product market fit continues to be difficult to find, and the reality is that members of our team are feeling the itch to explore other pursuits," they wrote. "We’d hoped that by now the rest of the world’s industries would have begun adopting blockchain tech at a larger scale, but that still feels a ways away."

Azuki community pays $38 million for recycled artwork that immediately drops in value

Two NFTs side-by side. Both depict anime style women, in profile, with long pink hair and a weapon over their shoulder, with a flower in their hair.Azuki and Azuki Elementals NFTs (attribution)
The blue-chip "Azuki" NFT brand opened sales on June 27 for its latest NFT collection, a 20,000-piece project called "Elementals". Eager to get in on the Azuki action, people snapped up the 2 ETH (~$3,750) NFTs, netting Azuki 20,000 ETH (~$38 million) in primary sales alone. All NFTs were sold in the presale, meaning only existing holders of Azuki NFTs were able to buy in to the new project. As is somewhat common, the artwork itself was not visible prior to sales, meaning people bought the NFTs without knowing what they would look like until the art was revealed.

The mint itself was plagued with issues, with many collectors complaining they weren't able to buy NFTs due to technical difficulties. A team member apologized for the issues, writing that they were "gutted over what happened" but that "we have an amazing reveal experienced planned that will kick off soon".

When the reveal happened, people were disappointed to say the least. They expected a unique look that would not "dilute" the value of the original Azuki collection, and were met with what many feel is a low-effort clone of the original Azukis. Some observed NFTs in the Elementals collection that appeared to be direct duplicates of ones in the original collection, which Azuki later wrote was a "technical glitch" that was quickly corrected. The floor price of the Elemental NFTs, as well as those of other Azuki projects, immediately suffered. While people paid 2 ETH for the NFTs, they're now going for 1.5 ETH (~$2,825) at floor, a 0.5 ETH (~$925) loss. The floor price of the original Azuki collection tanked from ~15 ETH (~$28,200) to ~9 ETH (~$16,920), a 6 ETH ($11,280) loss.

Azuki wrote an apologetic thread on Twitter, writing that they had "missed the mark... the mint process was hectic, the PFPs feel similar and, even worse, dilutive to Azuki." Perhaps they will wipe their tears with some of the 20,000 ETH they're sitting on.

No JavaScript? That's cool too! Check out the Web 1.0 version of the site to see more entries.