The "AI-optimized" defi project Mozaic Fi was exploited by an attacker who drained around $2&nbsp;million in funds from the project.<p>According to MozaicFi, the theft had been perpetrated by a rogue developer who was able to gain access to a private key held by a core team member. They also claimed that a simultaneous large sale of the Mozaic token resulted in cascading liquidations.</p><p>In good news for the project, the attacker moved around 90% of the stolen funds to MEXC, a centralized cryptocurrency exchange that was able to freeze the thief's access to the funds.</p>

Mozaic exploit

Mozaic exploited for $2&nbsp;million, recovers 90%

The decentralized lending protocol, MOBOX, was exploited on March 14, 2024 after an attacker was able to take advantage of a bug in its referral program and borrowing functionality. By repeatedly borrowing funds and earning rewards, they were able to drain around $750,000 in USDT.

MOBOX exploit

MOBOX lending platform exploited for $750,000

An Ethereum holder who had been <button class="define-target" id="staking">staking</button> their ETH through a liquid restaking protocol called Ether.fi suffered a 501&nbsp;ETH (~$2.025&nbsp;million) loss when they fell victim to a phishing scam. They inadvertently signed a malicious transaction that granted the attacker "increase allowance" permissions, enabling them to siphon almost the entire sum of funds from the wallet. The individual was left with less than $1,500 in the wallet.

ether.fi phishing

Phishing attack drains $2&nbsp;million from one victim

The U.S. Attorney's Office in the District of Massachusetts announced that they had filed a civil forfeiture action to seize cryptocurrency priced at around $2.3&nbsp;million from two Binance accounts. Those accounts had received cryptocurrency of various kinds from at least 37 American victims, one of whom was based in Massachusetts and who lost $400,000 in crypto assets to the scammers.

, United States Attorney's Office, District of Massachusetts

"United States Files Forfeiture Action to Recover Cryptocurrency Traceable to Pig Butchering Romance Scam"

Massachusetts crypto romance scam

Massachusetts prosecutors seek to seize $2.3&nbsp;million from crypto romance scam

Since March 5, those who used the Incognito Market darkweb narcotics marketplace have found themselves unable to withdraw the Bitcoin and Monero they had on the platform. It appeared the platform had exit scammed for somewhere between $10 and $30&nbsp;million.<p>Making matters worse, on March 10 the website posted a message reading, "Yes, this is an extortion !!" They wrote that, although the platform promised to "auto-encrypt" messages between buyers and sellers, and auto-delete after an expiry date, messages were not encrypted or deleted. They demanded that users pay an additional $100 to $20,000 to have their information removed from the dataset, which they promised to release at the end of May. "Whether or not you and your customers' info is on that list is totally up to you."</p><p>The tactic is reminiscent of that of ransomware groups, which often demand double fees: one from victims of hacks first to regain access to their systems, and another in exchange for a promise to destroy stolen data.</p>

Incognito Darknet Market Mass-Extorts Buyers, Sellers

Incognito Market exit scam

Incognito Market drug marketplace pulls multi-million dollar double scam

Scam Sniffer's February 2024 report describes 57,000 victims who collectively lost almost $47&nbsp;million thanks to various phishing schemes on the Twitter platform. Many of the losses came from accounts designed to impersonate various popular cryptocurrency projects, who diverted users to scam websites resembling the real ones.<p>The largest individual loss was the <a href="https://www.web3isgoinggreat.com/?id=kirilmeth-phishing" target="_blank">phishing attack against kirilm.eth</a>, who had over 180&nbsp;million $BEAM tokens notionally worth over $5&nbsp;million drained from their crypto wallet. The attacker sold the tokens for around $4.5&nbsp;million.</p><p>The total amount stolen is down slightly from <a href="https://www.web3isgoinggreat.com/?id=january-2024-twitter-phishing" target="_blank">January, in which $55&nbsp;million was taken</a>. Altogether, scammers have stolen over $100&nbsp;million via Twitter phishing alone in the first two months of 2024.</p> 

February 2024 Scam Sniffer Phishing Report

February 2024 Twitter phishing

Twitter phishers steal over $46&nbsp;million from 57,000 victims in February

The Unizen defi platform lost around $2.1&nbsp;million in the Tether stablecoin in an attack that took advantage of a vulnerability an external call from the project <button class="define-target" id="smart-contract">smart contract</button>.<p>The project team sent on-chain messages to the attacker, offering a 20% "<button class="define-target" id="bug-bount">bounty</button>" for the return of the remaining funds.</p>

Unizen hack

Unizen platform hacked for $2.1&nbsp;million

An attacker was able to use a <button class="define-target" id="flash-loan">flash loan</button> attack to <button class="define-target" id="oracle-manipulation">manipulate an oracle</button> on the WooFi <button class="define-target" id="dex">DEX</button> implementation on the Arbitrum network. By manipulating the price of $WOO, they were able to steal around $8.5&nbsp;million.<p>Blockchain security firms detected the attack quickly, and the project team paused the project's <button class="define-target" id="smart-contract">smart contract</button> within fifteen minutes, but not before the millions were stolen. They contacted the attacker via an on-chain message to offer a 10% "bounty", later threatening that they had a "strong lead that we think will soon reveal the identity of the exploiter".</p>

WOOFi hack

WOOFi hacked for $8.75&nbsp;million

Someone who held over 111.6&nbsp;million ALI tokens from a project called The AI Protocol was phished by someone using a <button class="define-target" id="wallet-drainer">wallet drainer</button> service using a <button class="define-target" id="permit-phishing">permit phishing</button> technique. The tokens were priced at around $4.3&nbsp;million.<p>Blockchain sleuth zachxbt was able to coordinate with the project to organize a community governance vote to <button class="define-target" id="burn">burn</button> the stolen tokens before the attacker was able to cash out. Although this doesn't return the stolen funds to their original owner, it at least keeps the attacker from profiting.</p>

AI Protocol theft and burn

"The AI Protocol" burns tokens after holder suffers $4.3&nbsp;million theft

A bug in Seneca Protocol's <button class="define-target" id="smart-contract">smart contract</button> has allowed attackers to steal funds from users who had approved the contract. So far, around $3&nbsp;million has been stolen across the Ethereum blockchain and Arbitrum <button class="define-target" id="layer-2">layer-2</button>.<p>Making things worse, although the project's smart contract inherits the <code>Pausable</code> module that should allow the Seneca team to halt the malfunctioning code, they never implemented the function, meaning there's no way for them to stop the thefts. Instead, individual users must each revoke access to the flawed contract.</p>

Seneca Protocol bug

Seneca Protocol bug enables at least $3&nbsp;million in stolen user funds

The Shido blockchain suffered an exploit of their <button class="define-target" id="staking">staking</button> <button class="define-target" id="smart-contract">smart contract</button>, in which an attacker was able to transfer ownership of the contract to another address and then upgrade the contract with a function that allowed them to withdraw staked tokens. Altogether, the attacker withdrew all 4.3&nbsp;billion staked $SHIDO tokens — over half the entire circulating supply.<p>Although the stolen tokens were nominally priced at $35&nbsp;million, the massive theft caused the price to plummet 94%. The attacker has converted the stolen tokens to around 956&nbsp;ETH ($3.3&nbsp;million).</p><p>The Shido team announced that they would be trying to offer a "<button class="define-target" id="bug-bounty">bounty</button>" to the hacker.</p>

"Shido token plummets 94% as exploiter drains Ethereum staking contract"

Shido contract exploit

Shido exploited for at least $3.3&nbsp;million

Serenity Shield, a project aiming to solve "crypto inheritence", has been hacked. Although the project prominently claims to help "ensur[e] your financial and personal security", they seem to have some trouble ensuring their own.<p>An attacker stole 6.9&nbsp;SERSH tokens from a MetaMask wallet belonging to the project. Although the tokens were <a href="https://blog.mollywhite.net/cryptocurrency-market-caps-and-notional-value/" target="_blank">ostensibly priced</a> at $5.6&nbsp;million, the thief was only able to sell them for around $586,000.</p><p>Serenity Shield confirmed the breach, and encouraged people to stop trading $SERSH as they planned to relaunch the token. "Rest assured, we are deploying all necessary safety measures to ensure a foolproof system," they wrote. This time it will be secure, they promise.</p><p>The team also sent a message to the hacker, offering a 15% "bounty" and a promise not to pursue legal action in exchange for the return of the stolen funds.</p><p>According to crypto sleuth zachxbt, the attack seems to be linked to exploits of <a href="https://www.web3isgoinggreat.com/?id=okx-dex-hack" target="_blank">OKX</a> (December 2023) and <a href="https://www.web3isgoinggreat.com/?id=concentric-finance-exploit" target="_blank">Concentric</a> (January 2024).</p>

Serenity Shield hack

"Crypto inheritence" project Serenity Shield hacked, token price plummets 99%

The Hong Kong-based BitForex cryptocurrency exchange has shut down access to its platform after a suspicious outflow of around $57&nbsp;million on several blockchains. Users who have tried to log in see a <a href="https://en.wikipedia.org/wiki/Cloudflare" target="_blank">CloudFlare</a> page explaining that they are blocked from accessing the website by CloudFlare's <a href="https://en.wikipedia.org/wiki/DDoS_mitigation" target="_blank">DDoS protection</a> service.<p>The withdrawals were first noticed by blockchain detective zachxbt, who also noted that the exchange has stopped processing withdrawals and has not been replying to customer support inquiries.</p><p>It seems likely that the outflows were an exit scam rather than an outside attack, particularly given the lack of communication and somewhat shady status of the exchange. The firm faced regulatory scrutiny in Japan in mid-2023 for operating without a license, and has been accused of inflating its trading volume. Its CEO resigned in January, but promised a new team would be taking over.</p>

"BitForex Website Goes Dark Amid Reported $57M Outflow"

"BitForex alleged $2.5 billion volume flatlines as exchange abruptly goes offline"

BitForex withdrawals

BitForex shuts off website after $57&nbsp;million withdrawal

MicroStrategy, the company founded and chaired by Bitcoin maximalist Michael Saylor, suffered a Twitter account compromise on February 26. Although MicroStrategy ostensibly develops software, it's better known for its massive Bitcoin holdings, driven by Saylor.<p>Although Saylor has been publicly critical of Ethereum, that didn't seem to raise flags among those eager to receive an <button class="define-target" id="airdrop">airdrop</button> of the Ethereum-based "MSTR" token that the company's Twitter account claimed they had just launched. Those who fell for the phishing link were redirected to a website that spoofed the real MicroStrategy website, with malicious code that drained funds.</p><p>Around $440,000 was stolen thanks to the fake announcement, with the majority of it coming from one wallet that was drained of a variety of tokens notionally worth around $425,000.</p>

"Hackers exploit MicroStrategy social media to orchestrate $440,000 phishing heist"

MicroStrategy Twitter hack

$440,000 stolen as MicroStrategy's Twitter account is hacked

RiskOnBlast, a gambling and trading platform on the new ethereum <button class="define-target" id="layer-2">layer-2</button> Blast blockchain, appears to have performed the blockchain's first major <button class="define-target" id="rug-pull">rug pull</button> — before the blockchain has even officially launched. Blast was created by the developers of the Blur NFT platform, and received funding from the Paradigm crypto VC.<p>The team behind Blast had even helped to promote the RiskOnBlast platform, tweeting from its official account that Blast was "a new challenger" in the ecosystem with "undeniable" potential.</p><p>On February 25, the platform drained more than 420&nbsp;ETH (~$1.3&nbsp;million) from more than 750 user wallets on their platform. The project's anonymous team then laundered the funds through various services and exchanges. All social media accounts for the project were taken offline.</p>

"Blast Ecosystem Sees First Apparent Scam as 'RiskOnBlast' Rug Pulls $1.3M Ether"

RiskOnBlast gambling platform rug pulls for $1.3&nbsp;million

A <button class="define-target" id="pig-butchering">pig-butchering</button> operation in Myanmar has scammed victims of more than $100&nbsp;million in <a href="https://www.web3isgoinggreat.com/?collection=tether" target="_blank">Tether</a> in less than two years, according to a report from Chainalysis and the anti-human trafficking organization <a href="https://en.wikipedia.org/wiki/International_Justice_Mission" target="_blank">International Justice Mission</a>.<p>Many of the workers for the romance scam group are themselves victims of human trafficking. The operation is based in a "compound" near Myanmar's border with Thailand, and researchers estimate that thousands of trafficked workers operate the scam from the "self-contained city".</p><p>The scam may put more pressure on Tether, whose role in human trafficking and high-volume romance scam operations has been scrutinized more heavily in recent months and years. Tether has frozen some assets belonging to romance scammers in the past, but remains the token of choice for many of these groups.</p>

"$100mn in crypto payments traced to Myanmar-based 'scammers'"

Myanmar-based pig-butchering scam

Myanmar-based romance scam operation pulls in $100&nbsp;million in less than two years

When businessman Kow Seng Chai transferred AU$99,500 (~US$65,000) to a cryptocurrency account on the Australian OTCPro cryptocurrency trading platform on January 25, he received an unexpected windfall thanks to an extra 0 erroneously added to the amount. When he saw the AU$995,000 ($650,000) in his account, he set to work, cashing out the excess funds through multiple withdrawals of the maximum amount.<p>OTCPro didn't notice their error until February 4, by which point Chai had already disappeared. They were able to recoup some funds that Chai had left in the OTCPro account, putting their total loss at around AU$490,000 (US$320,000).</p><p>A judge issued an injunction to try to prevent Chai from leaving the country, and issued a freeze on his assets. However, a freeze may be ineffective depending on if and how Chai has laundered the funds.</p>

"Victorian man vanishes after receiving about $500,000 in cryptocurrency account error"

Kow Seng Chai disappearance

Australian disappears with more than US$585,000 erroneously transferred to his cryptocurrency account by OTCPro

Jeff "Jihoz" Zirlin, a co-founder of the <i>Axie Infinity</i> blockchain game, lost around $9.5&nbsp;million as two of his crypto wallets were compromised. The thief stole 3,248&nbsp;ETH ($9.5&nbsp;million), which they quickly laundered with the Tornado Cash cryptocurrency <button class="define-target" id="tumbler">mixer</button>.<p>Some were briefly concerned that <i>Axie Infinity's</i> Ronin Bridge had been hacked (<a href="https://www.web3isgoinggreat.com/?id=axie-infinity-suffers-625-million-exploit" target="_blank">again</a>), since the funds moved out of the <button class="define-target" id="bridge">bridge</button>. Jihoz and others were quick to emphasize that the bridge had not been affected, and it was simply a personal wallet compromise.</p>

Jihoz Zirlin wallet hack

<i>Axie Infinity</i> co-founder suffers $9.5&nbsp;million loss after wallet compromise

I might otherwise skip over news of a $170,000 hack, given how commonly thefts of that scale happen in the crypto world, but with a name like this... come on.<p>One thing that keeps me from ever trying my hand as a crypto project hacker is that if I made $170,000 from exploiting a project called "DeezNutz_404", I would immediately be caught because I wouldn't be able to resist telling everyone I know that I'd just made enough money to not have to work for a couple years by exploiting <i>deez nuts</i>.</p><p>Anyway, there was a bug in their code that allowed an attacker to mint infinite tokens and steal around 58.65&nbsp;ETH (~$170,000).</p>

DeezNutz_404 hack

DeezNutz_404 hacked for $170,000

The Blueberry <button class="define-target" id="defi">defi</button> leverage project had a bug in their lending contract, where improper decimal handling allowed for an exploit. An attacker tried to exploit the vulnerability, but was <button class="define-target" id="front-running">front-run</button> by c0ffeebabe.eth, a well-known <button class="define-target" id="mev">MEV</button> bot operator and <button class="define-target" id="whitehat">whitehat</button> who has in the past been able to front-run other exploits and return the funds to the projects.<p>About 457.7&nbsp;ETH ($1.35&nbsp;million) was drained from the project, but 366.6&nbsp;ETH ($1.08&nbsp;million) of that was able to be returned. The remaining ~91&nbsp;ETH (~$265,000) was lost to <button class="define-target" id="mining">validator</button> payments.</p><p>Blueberry paused their protocol as they investigated the hack, and stated that they "aim for a full repayment to users as the goal".</p>

Blueberry Protocol narrowly avoids $1.3&nbsp;million hack

The Hong Kong-based AAX cryptocurrency exchange <a href="https://www.web3isgoinggreat.com/?id=aax-cryptocurrency-exchange-suspends-withdrawals" target="_blank">suspended withdrawals</a> in November 2022, only days after the FTX collapse and related chaos in the cryptocurrency world. They claimed that user funds were safe, but the exchange never restored service. A month later, <a href="https://www.web3isgoinggreat.com/?id=police-arrest-two-executives-of-shuttered-aax-exchange" target="_blank">police arrested two of the company's executives</a>.<p>Now, over a year later, the Cyvers blockchain security firm has observed more than 24,000&nbsp;ETH (~$55.6&nbsp;million) has been moved from wallets used by the platform. Although there could be innocuous explanations for money moving off a defunct platform, whoever was moving the funds used various decentralized services to launder the money, appearing to be trying to make it more difficult to trace.</p>

AAX money movement

Over $55&nbsp;million taken from defunct AAX crypto exchange

The FixedFloat cryptocurrency exchange was exploited for around 409&nbsp;BTC (~$21.17&nbsp;million) and 1,728&nbsp;ETH (~$4.85&nbsp;million) for a total loss of just over $26&nbsp;million. FixedFloat is a <button class="define-target" id="dex">decentralized cryptocurrency exchange</button> that doesn't require user registration or <button class="define-target" id="kyc">Know Your Customer</button>, making it popular for hackers looking to launder stolen funds.<p>FixedFloat first wrote that they had "encountered some minor technical problems", then acknowledged that there had been a hack. FixedFloat is non-custodial, so no user funds were impacted, however some have reported frozen transactions and missing funds from using the service on social media.</p>

"FixedFloat confirms $26M exploit in Bitcoin, Ether"

FixedFloat hack #1

FixedFloat exchange hacked for $26&nbsp;million

A trader known as kirilm.eth fell victim to a phishing attack, losing over 180&nbsp;million BEAM tokens to a scammer. BEAM is a token belonging to the Beam blockchain gaming network, built by the Merit Circle DAO.<p>The stolen tokens were notionally priced at around $5.14&nbsp;million, although the sale of the stolen tokens resulted in a price drop that meant the attacker ultimately was only able to trade them for 1,629&nbsp;ETH (~$4.5&nbsp;million). The BEAM price dropped around 10%.</p>

"kirilm.eth Falls Victim To Phishing, Loses 180 Mln BEAM"

Event	Date	Amount More info	Recovered More info
Mozaic exploit	March 15, 2024	$2,000,000	$1,800,000
MOBOX exploit	March 14, 2024	$750,000
ether.fi phishing	March 13, 2024	$2,025,000
Massachusetts crypto romance scam	March 13, 2024	$2,300,000
Incognito Market exit scam	March 11, 2024	$10,000,000 – $30,000,000
February 2024 Twitter phishing	March 10, 2024	$42,363,781
Unizen hack	March 8, 2024	$2,100,000
WOOFi hack	March 5, 2024	$8,750,000
AI Protocol theft and burn	March 1, 2024	$4,300,000
Seneca Protocol bug	February 28, 2024	$6,400,000	$5,200,000
Shido contract exploit	February 28, 2024	$3,300,000
Serenity Shield hack	February 27, 2024	$586,000
BitForex withdrawals	February 26, 2024	$57,000,000
MicroStrategy Twitter hack	February 26, 2024	$440,000
RiskOnBlast gambling platform rug pulls for $1.3 million	February 25, 2024	$13,250,000
Myanmar-based pig-butchering scam	February 25, 2024	$100,000,000
Kow Seng Chai disappearance	February 24, 2024	$650,000	$330,000
Jihoz Zirlin wallet hack	February 22, 2024	$9,500,000
DeezNutz_404 hack	February 22, 2024	$170,000
Blueberry Protocol narrowly avoids $1.3 million hack	February 22, 2024	$1,345,000	$1,080,000
AAX money movement	February 20, 2024	$55,600,000
FixedFloat hack #1	February 18, 2024	$26,100,000
kirilm.eth phishing	February 16, 2024	$4,500,000