Crypto sleuths Coffeezilla and zachxbt teamed up on an investigation into YouTuber and crypto promoter KSI, accusing him of pumping up interest into the XCAD project and then dumping tokens priced at $850,000 shortly after, when some of his millions of followers had likely bought in and pumped the price.<p>Although the token dumping occurred in March 2022, zachxbt waited until now — when KSI returned to his dormant Twitter account — to release the evidence he'd collected.</p><p>KSI had previously claimed to followers that he was "holding his bags", meaning not selling the XCAD tokens he'd purchased or been given. zachxbt determined this to have been a lie. The XCAD founder later came to KSI's defense, claiming he had bought more tokens than he sold, as though that somehow justifies the behavior.</p>

"KSI Accidentally Exposes His Crypto Scams"

YouTuber KSI accused of pump-and-dump

The Duelbits crypto casino and sports betting website was drained of around $4.6&nbsp;million on both the Ethereum and BNB Chain blockchains. The funds were quickly <button class="define-target" id="bridge">bridged</button> or exchanged to ETH.<p>It appears that the thief got access to a Duelbits <button class="define-target" id="wallet">wallet</button>, perhaps through a <button class="define-target" id="private-key">private key</button> compromise.</p>

Duelbits hack

Duelbits crypto casino exploited for $4.6&nbsp;million

The South Korean blockchain gaming platform PlayDapp was hacked on February 9, and an attacker minted 200&nbsp;million $PLA tokens. These were notionally priced at around $36.5&nbsp;million, although because only 577&nbsp;million $PLA were in circulation before the unauthorized mint, there would not have been sufficient liquidity for the attacker to sell them at around that price.<p>Days after the initial attack, on February 12, the attacker minted another 1.59&nbsp;<i>billion</i> $PLA. This has led to news reports that the platform was exploited for "$290&nbsp;million". However, this value is being naively calculated based on the token price without taking into account the massive supply inflation, and ignoring that that dollar figure is more than 2.5x the total claimed market cap of the token. Even reputable outlets like <i>Bleeping Computer</i> have printed the figure in their headline (though <i>Bleeping Computer</i> later changed the headline to a more accurate one).</p><p>PlayDapp sent on-chain messages to the attacker, offering a bounty, but the offer was ignored.</p>

"PlayDapp exploit continues into 4th day, with losses reaching $290M"

"Hackers steal $290 million in crypto from PlayDapp gaming platform"

PlayDapp crypto gaming platform exploited, spurring misleading headlines

Blockchain sleuth zachxbt noticed the strange movement of around 213&nbsp;million XRP, the native token for the Ripple project. These tokens were priced at around $112.5&nbsp;million at the time of the theft. He originally identified the source of funds as Ripple itself, though Ripple CEO Chris Larsen later went on Twitter to claim that the funds that were stolen had come from his personal wallets and not from wallets belonging to the Ripple project.<p>Larsen attempted to downplay the massive theft, claiming repeatedly that the theft did not represent a threat to Ripple itself, and trying to reassure people that Ripple wallets are still safe. However, fears over a threat to Ripple itself and the true separation between Larsen's wallets and those belonging to the Ripple project continued, and XRP dipped around 5% on the news.</p>

"Hackers steal $112 million of XRP Ripple cryptocurrency"

Chris Larsen XRP theft

$112.5&nbsp;million in XRP stolen from Ripple CEO Chris Larsen

Scam Sniffer's January 2024 report describes more than 40,000 victims who collectively lost more than $58&nbsp;million thanks to various phishing schemes on the Twitter platform.<p>The top seven victims collectively lost $17&nbsp;million, with the top victim alone losing $4.7&nbsp;million.</p>

"Scam Sniffer Report: $55 Million Stolen Due To Phishing In January"

January 2024 Twitter phishing

More than $58&nbsp;million stolen in Twitter phishing schemes in January

Well that sure is a headline I just had to write.<p>The Magic Internet Money ($MIM) stablecoin has lost its dollar <button class="define-target" id="peg">peg</button> again, dipping all the way below $0.77 in a flash crash before returning to around $0.95.</p><p>The depeg appears to be related to an exploit of the Abracadabra lending protocol, which allows people to borrow $MIM. An attacker exploited an apparent flaw in the platform's smart contracts to drain around $6.5&nbsp;million.</p><p>This is the second time the token has depegged, after a <a href="https://web3isgoinggreat.com/?id=magic-internet-money-stablecoin-wobbles" target="_blank">June 2022 incident</a> shortly after the <a href="https://web3isgoinggreat.com/?id=terra-luna-token-drops-in-price-by-98-amidst-ongoing-terrausd-stablecoin-collapse" target="_blank">Terra collapse</a>.</p>

"Abracadabra's $6.49M loss leads to MIM stablecoin destabilization"

Abracadabra exploit

Abracadabra exploited for almost $6.5&nbsp;million, Magic Internet Money stablecoin depegs

Goledo Finance, an Aave-based lending protocol, was exploited through a <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker stole assets estimated by CertiK at around $1.7&nbsp;million.<p>Goledo Finance contacted the attacker to offer a 10% "<button class="define-target" id="bug-bounty">bounty</button>" for the return of the remaining assets. In a message on January 29, the attacker wrote: "I hacked Goledo and want to negotiate".</p>

Goledo Finance hack

Goledo Finance hacked for $1.7&nbsp;million

Have you ever gone out to karaoke and thought "man, the only thing missing from this perfect night is a blockchain"? No? Weird.<p>Anyway, the South Korean Somesing platform — which is really more of a TikTok-but-just-for-song-covers clone than anything to do with karaoke — suffered a breach in which 730&nbsp;million SSX tokens were stolen. These tokens are nominally priced at around $11.5&nbsp;million, but around 2/3 of the stolen tokens were as yet undistributed and not a part of the circulating supply.</p>

"South Korea's crypto karaoke platform hacked for over $11.5 million"

"Emergency notice following the hacking incident of SSX tokens"

Somesing hack

Korean crypto karaoke platform Somesing hacked

Hackers were able to exploit a vulnerability in the <button class="define-target" id="staking">staking</button> <button class="define-target" id="smart-contract">contract</button> for WallStreetMemes ($WSM), a <button class="define-target" id="memecoin">memecoin</button> and online casino project targeted at the "meme warriors" who frequent various financial meme communities, many of which formed around the <a href="https://en.wikipedia.org/wiki/GameStop_short_squeeze" target="_blank">Gamestop short squeeze</a>.<p>The attackers were able to siphon 769&nbsp;million $WSM from the contract, which was notionally worth around $7&nbsp;million. However, the token lacks liquidity to support swapping hundreds of millions of tokens without depressing the price, and the token price dropped around 35% in the wake of the attack as the thief began to cash out over several days.</p><p>Meanwhile, WSM announced that they would be issuing a new token to replace the stolen tokens, and "renew[ing] the liquidity pool"... somehow.</p>

WallStreetMemes exploit

WallStreetMemes token price plummets after staking contract exploited

After hackers gained access to various accounts on the MailerLite email marketing software via a social engineering attack on an employee, they were able to send malicious phishing emails that appeared as though they had been genuinely sent from companies including the <i>CoinTelegraph</i> crypto media outlet and the crypto firms Wallet Connect, Token Terminal, SocialFi, and De.Fi.<p>The emails appeared to announce airdrops and exclusive offers from those companies, and recipients were invited to connect their wallets to claim tokens. Those wallets were then drained.</p><p>The attackers stole a variety of cryptocurrencies, and some outlets have reported the theft has totalled more than $3.3&nbsp;million. However, because a substantial amount of that number comes from the illiquid Xbanking token, the actual liquid value of the tokens is likely closer to $700,000. The attackers have begun <button class="define-target" id="tumbler">mixing</button> the stolen funds through the Railgun privacy service.</p>

"MailerLite confirms hack that led to $3.3M crypto-phishing email attacks"

"Coordinated crypto hack and phishing campaign floods investor emails: Alert"

"Mailer Lite hacker impersonates crypto firms, draining $600,000 with phishing emails"

MailerLite hack

MailerLite hack enables over $700,000 in crypto phishing thefts

The Concentric Finance <button class="define-target" id="yield-aggregator">yield aggregator</button> project issued a statement that the protocol had been exploited after a social engineering attack on a team member that had access to the project's <button class="define-target" id="deployer">deployer</button> wallet.<p>Tokens priced at around $1.8&nbsp;million were drained from the project vaults. In a tweet, Concentric urged users to revoke contract approvals to avoid further losses.</p><p>The wallet addresses used by the exploiter appeared to connect the attacker to the <a href="https://web3isgoinggreat.com/?id=okx-dex-hack" target="_blank">$2.7&nbsp;million OKX DEX theft</a> in December 2023.</p>

Concentric Finance exploit

Concentric Finance exploited for $1.8&nbsp;million

An attacker was able to gain access to the Gamee (GMEE) token's source code repository, then exploit a vulnerability in the code to transfer 600&nbsp;million GMEE tokens to their own wallets. At the token's market price of $0.025 before the hack, these tokens were ostensibly priced at $15&nbsp;million, though the token value plunged around 60% to below $0.01 following the theft as the attacker began selling the tokens.<p>GMEE is the token belonging to the Gamee blockchain-based gaming platform, which was acquired by the Animoca Brands company in 2020. Animoca is mostly known for its crypto-metaverse project, The Sandbox.</p>

"Animoca Brands' Gamee Token Plunges 60% After Exploit"

Animoca Brands-owned Gamee tokens stolen

The CFTC has filed a complaint against Debiex, a shadowy cryptocurrency platform whose precise location and executives are unknown. The company's employees primarily targeted Chinese Americans, and used common romance scam techniques: first striking up a friendship or romantic relationship with the victim, then convincing them that they could earn huge profits by putting money on Debiex.<p>Debiex, however, only resembled a cryptocurrency trading platform. In reality, the website merely mimicked a trading platform, and the funds supposedly deposited there for trading purposes were taken by Debiex.</p><p>The CFTC identified five victims who were allegedly defrauded of a combined $2.3&nbsp;million.</p>

"CFTC Charges Bogus Digital Asset Platform with Fraud and Misappropriation in an Online Romance Scam"

Debiex CFTC complaint

CFTC files complaint against Debiex platform for using "romance scam tactics" to steal $2.3&nbsp;million

A Colorado-based pastor for an online ministry sold INDXcoin to his followers and others in the Christian faith. However, there was no way for buyers to cash out the tokens. Meanwhile, Regalado and his wife spent the money on a Rolls Royce, jewelry, and designer handbags — and, according to Regalado, "a home renovation the Lord told us to do."<p>Regalado posted a video to his supporters explaining that he had been sued by the Colorado state securities regulator. "So the charges are that Kaitlyn and I pocketed $1.3 million, and I just want to come out and say that those uh charges are true," said Regalado in the video, presumably causing a cold chill to run down the spine of his defense attorney in the middle of whatever he was doing.</p><p>According to Regalado, God told them to first invest in a separate coin, which turned out to be a scam. Then, says Regalado, God told him to make his own currency, which Regalado called INDXcoin, "but also give them a 10x". Who knew God was a <button class="define-target" id="degen">degen</button>! Regalado had told investors that the funds would be going to "widows and orphans", but spent most of it on himself and his wife.</p>

, Colorado Division of Securities press release

"Colorado Securities Commissioner Files Complaint Against Alleged Cryptocurrency Fraud Scheme"

"Pastor pocketed $1.3M selling worthless cryptocurrency, state says"

INDXcoin

Colorado pastor charged for cryptocurrency scam he says he perpetrated at God's command

The Socket cross-chain infrastructure protocol was hacked for around $3.3&nbsp;million in an attack that exploited its Bungee <button class="define-target" id="bridge">bridge</button>. The thieves were able to exploit a bug that allowed them to take assets from those who had granted approval to a portion of the system called SocketGateway.<p>A little over 700&nbsp;victims were affected, and the highest loss from a single wallet was around $657,000. 121 wallets lost assets priced at more than $10,000.</p><p>On January 23, the protocol announced they had recovered 1,032&nbsp;ETH (~$2.23&nbsp;million) of the stolen funds.</p>

"Socket, Bungee Restart Operations After Apparent $3.3M Exploit"

"Socket Tech security breach affects multiple dapps and wallets"

Socket hack

Socket service and its Bungee bridge suffer $3.3&nbsp;million theft

In July 2023, <a href="https://web3isgoinggreat.com/?id=hector-dao-shuts-down" target="_blank">angry investors in the Hector Network project opted to "rage quit"</a> — an option reserved by some <button class="define-target" id="defi">defi</button> projects that allows investors to vote to liquidate a project's remaining treasury and distribute it to token holders. The successful rage-quit vote in Hector's case came after the protocol lost $8&nbsp;million in the <a href="https://web3isgoinggreat.com/?collection=multichain" target="_blank">Multichain disaster</a>, although investors say that was only the final straw in a series of poor management choices and inflated salaries that saw the project treasury dwindle from over $100&nbsp;million to around $16&nbsp;million.<p>Now, another $2.7&nbsp;million is gone after an apparent thief was able to exploit a <button class="define-target" id="smart-contract">smart contract</button> that was intended to distribute payouts to Hector's token holders. They then swapped the tokens from the USDC stablecoin to ETH.</p><p>Investors in the project are furious, especially because various parties had warned Hector Network about apparently insecure practices. Hector Network's team, meanwhile, have not acknowledged the theft, although a law firm involved in the project liquidation promised a statement would be forthcoming.</p>

"Mysterious $2.7 million withdrawal from Hector Network leaves investors perplexed"

"Investors rip Hector Network team after it squanders $100m treasury and ‘rage quits’ DeFi project"

Event	Date	Amount More info	Recovered More info
YouTuber KSI accused of pump-and-dump	February 15, 2024	$850,000
Duelbits hack	February 13, 2024	$4,600,000
PlayDapp crypto gaming platform exploited, spurring misleading headlines	February 9, 2024	$20,000,000 – $36,500,000
Chris Larsen XRP theft	January 31, 2024	$112,500,000	$4,200,000
January 2024 Twitter phishing	January 31, 2024	$58,324,698
Abracadabra exploit	January 30, 2024	$6,490,000
Goledo Finance hack	January 28, 2024	$1,700,000
Somesing hack	January 27, 2024	$11,580,000
WallStreetMemes exploit	January 25, 2024	$6,000,000 – $7,000,000
MailerLite hack	January 23, 2024	$700,000
Concentric Finance exploit	January 22, 2024	$1,800,000
Animoca Brands-owned Gamee tokens stolen	January 22, 2024	$6,000,000
Debiex CFTC complaint	January 19, 2024	$2,300,000
INDXcoin	January 18, 2024	$1,300,000
Socket hack	January 16, 2024	$3,300,000	$2,300,000
Hector Network compensation fund theft	January 16, 2024	$2,700,000