"The AI Protocol" burns tokens after holder suffers $4.3 million theft

Someone who held over 111.6 million ALI tokens from a project called The AI Protocol was phished by someone using a wallet drainer service using a permit phishing technique. The tokens were priced at around $4.3 million.

Blockchain sleuth zachxbt was able to coordinate with the project to organize a community governance vote to burn the stolen tokens before the attacker was able to cash out. Although this doesn't return the stolen funds to their original owner, it at least keeps the attacker from profiting.

Shido exploited for at least $3.3 million

The Shido blockchain suffered an exploit of their staking smart contract, in which an attacker was able to transfer ownership of the contract to another address and then upgrade the contract with a function that allowed them to withdraw staked tokens. Altogether, the attacker withdrew all 4.3 billion staked $SHIDO tokens — over half the entire circulating supply.

Although the stolen tokens were nominally priced at $35 million, the massive theft caused the price to plummet 94%. The attacker has converted the stolen tokens to around 956 ETH ($3.3 million).

The Shido team announced that they would be trying to offer a "bounty" to the hacker.

Seneca Protocol bug enables at least $3 million in stolen user funds

A bug in Seneca Protocol's smart contract has allowed attackers to steal funds from users who had approved the contract. So far, around $3 million has been stolen across the Ethereum blockchain and Arbitrum layer-2.

Making things worse, although the project's smart contract inherits the Pausable module that should allow the Seneca team to halt the malfunctioning code, they never implemented the function, meaning there's no way for them to stop the thefts. Instead, individual users must each revoke access to the flawed contract.

"Crypto inheritence" project Serenity Shield hacked, token price plummets 99%

Serenity Shield, a project aiming to solve "crypto inheritence", has been hacked. Although the project prominently claims to help "ensur[e] your financial and personal security", they seem to have some trouble ensuring their own.

An attacker stole 6.9 SERSH tokens from a MetaMask wallet belonging to the project. Although the tokens were ostensibly priced at $5.6 million, the thief was only able to sell them for around $586,000.

Serenity Shield confirmed the breach, and encouraged people to stop trading $SERSH as they planned to relaunch the token. "Rest assured, we are deploying all necessary safety measures to ensure a foolproof system," they wrote. This time it will be secure, they promise.

The team also sent a message to the hacker, offering a 15% "bounty" and a promise not to pursue legal action in exchange for the return of the stolen funds.

According to crypto sleuth zachxbt, the attack seems to be linked to exploits of OKX (December 2023) and Concentric (January 2024).

Scammers hack Twitter account of late actor Matthew Perry, solicit "donations" for "substance abuse charity"

Matthew PerryMatthew Perry (attribution)
There are evidently no lows to which crypto scammers will not sink.

Some scammers were able to compromise the Twitter account belonging to the Friends star Matthew Perry, who passed away in October 2023. He had spent much of his life battling addiction, and his death was drug-related.

The scammers took advantage of this to share crypto addresses that they claimed would funnel donations to the real Matthew Perry Foundation, which actually tries to help those battling addiction. However, in a post on Perry's other social media accounts, the Foundation clarified that they had nothing to do with the wallets or the Twitter posts, and described the website as "fraudulent".

tea.xyz causes a flood of spam pull requests to open source projects

This crypto skeptic I've heard of once said "Show me the incentive and I will show you the outcome."

A project called tea.xyz promised people they could "get rewards for [their] open-source contributions", complete with a flashy website describing how it would "enhance the sustainability of open-source software".

So far, it's achieved the exact opposite. Promising to reward open source contributors with crypto tokens, the project asked users to verify their access to open source projects by merging in a YAML file containing their crypto wallet address. This kicked off a flood of pull requests to prominent, often non-crypto-related open source projects by people who had never contributed to the project (or, often, any open source project), but who wished to merge in a file describing them as a "code owner".

Particularly impacted by this project was the open source blogging platform Ghost, which was used as an example in the demo video released by tea.xyz, and which received several PRs of this kind. A somewhat flummoxed maintainer of the repository replied to one PR: "[I]n practice the TEA project is not helping to support the Ghost project, but is instead causing a rush of self-serving PRs to be submitted to cash-in on other people's work. ... This why people hate on crypto." A maintainer of another unrelated open source project called "ghost" also reported receiving an influx of spam PRs.

This is not the first time crypto has generated massive Github spam, although another recent incident was (blessedly) mostly limited to open-source crypto projects and didn't waste the time of non-crypto-related projects as this one has.

$440,000 stolen as MicroStrategy's Twitter account is hacked

Michael Saylor sitting in front of a large model shipMichael Saylor (attribution)
MicroStrategy, the company founded and chaired by Bitcoin maximalist Michael Saylor, suffered a Twitter account compromise on February 26. Although MicroStrategy ostensibly develops software, it's better known for its massive Bitcoin holdings, driven by Saylor.

Although Saylor has been publicly critical of Ethereum, that didn't seem to raise flags among those eager to receive an airdrop of the Ethereum-based "MSTR" token that the company's Twitter account claimed they had just launched. Those who fell for the phishing link were redirected to a website that spoofed the real MicroStrategy website, with malicious code that drained funds.

Around $440,000 was stolen thanks to the fake announcement, with the majority of it coming from one wallet that was drained of a variety of tokens notionally worth around $425,000.

Dechat announces its token launch with a link to the wrong token

The user experience in crypto is apparently so bad that platforms can't even keep their own tokens straight. A web3 messaging project, Dechat, announced with some fanfare that the Dechat token would begin trading. In their social media post, however, they erroneously linked to the wrong token on the PancakeSwap cryptocurrency exchange. Instead of linking to the token they had developed, they included a link to a honeypot: that is, a malicious smart contract that aims to entice people to deposit funds that can then be stolen.

"You clowns literally linked a honeypot for your own token launch," wrote crypto sleuth zachxbt. Some users replied that they had lost money to the erroneous link.

Dechat quickly removed the post and created a new one with a corrected link. They also promised to reimburse users who had lost money to the honeypot.

BitForex shuts off website after $57 million withdrawal

The Hong Kong-based BitForex cryptocurrency exchange has shut down access to its platform after a suspicious outflow of around $57 million on several blockchains. Users who have tried to log in see a CloudFlare page explaining that they are blocked from accessing the website by CloudFlare's DDoS protection service.

The withdrawals were first noticed by blockchain detective zachxbt, who also noted that the exchange has stopped processing withdrawals and has not been replying to customer support inquiries.

It seems likely that the outflows were an exit scam rather than an outside attack, particularly given the lack of communication and somewhat shady status of the exchange. The firm faced regulatory scrutiny in Japan in mid-2023 for operating without a license, and has been accused of inflating its trading volume. Its CEO resigned in January, but promised a new team would be taking over.

"Fully private" Aleo blockchain accidentally sends out copies of users' identification documents

Aleo, a blockchain project that advertises it's a place for "fully private applications" with "built-in privacy" has just emailed private identification documents — including selfies and photographs of government identification cards — to the wrong users.

A user posted on Twitter that they had received an email with someone else's identification. "That makes me wonder, if I have someone else's KYC document, who else have you sent mine to?" Another person replied to the thread that they had experienced the same thing.

Aleo acknowledged their screw-up on social media, claiming that only ten individuals were impacted, and that it had happened thanks to a "copy/paste error in email metadata".

Crypto tumbler Tornado Cash suffers code exploit, putting funds at risk

A community member of the Tornado Cash cryptocurrency tumbler project has reported that malicious code was added to the Tornado Cash project on January 1, which has put at risk funds deposited into the service. According to the community member, a successful governance proposal two months ago resulted in a code change, but malicious JavaScript included in the change went unnoticed.

The code leaks private notes associated with deposits to a "private malicious server" owned by the person who initiated the code change. Private notes on Tornado Cash are the keys that allow a person to later withdraw the funds they have deposited into the mixing service.

This is not the first time DAO governance has gone wrong for Tornado — in May 2023, the project underwent a hostile takeover via malicious code that went unnoticed.

Myanmar-based romance scam operation pulls in $100 million in less than two years

A pig-butchering operation in Myanmar has scammed victims of more than $100 million in Tether in less than two years, according to a report from Chainalysis and the anti-human trafficking organization International Justice Mission.

Many of the workers for the romance scam group are themselves victims of human trafficking. The operation is based in a "compound" near Myanmar's border with Thailand, and researchers estimate that thousands of trafficked workers operate the scam from the "self-contained city".

The scam may put more pressure on Tether, whose role in human trafficking and high-volume romance scam operations has been scrutinized more heavily in recent months and years. Tether has frozen some assets belonging to romance scammers in the past, but remains the token of choice for many of these groups.

RiskOnBlast gambling platform rug pulls for $1.3 million

RiskOnBlast, a gambling and trading platform on the new ethereum layer-2 Blast blockchain, appears to have performed the blockchain's first major rug pull — before the blockchain has even officially launched. Blast was created by the developers of the Blur NFT platform, and received funding from the Paradigm crypto VC.

The team behind Blast had even helped to promote the RiskOnBlast platform, tweeting from its official account that Blast was "a new challenger" in the ecosystem with "undeniable" potential.

On February 25, the platform drained more than 420 ETH (~$1.3 million) from more than 750 user wallets on their platform. The project's anonymous team then laundered the funds through various services and exchanges. All social media accounts for the project were taken offline.

Australian disappears with more than US$585,000 erroneously transferred to his cryptocurrency account by OTCPro

When businessman Kow Seng Chai transferred AU$99,500 (~US$65,000) to a cryptocurrency account on the Australian OTCPro cryptocurrency trading platform on January 25, he received an unexpected windfall thanks to an extra 0 erroneously added to the amount. When he saw the AU$995,000 ($650,000) in his account, he set to work, cashing out the excess funds through multiple withdrawals of the maximum amount.

OTCPro didn't notice their error until February 4, by which point Chai had already disappeared. They were able to recoup some funds that Chai had left in the OTCPro account, putting their total loss at around AU$490,000 (US$320,000).

A judge issued an injunction to try to prevent Chai from leaving the country, and issued a freeze on his assets. However, a freeze may be ineffective depending on if and how Chai has laundered the funds.

Blueberry Protocol narrowly avoids $1.3 million hack

The Blueberry defi leverage project had a bug in their lending contract, where improper decimal handling allowed for an exploit. An attacker tried to exploit the vulnerability, but was front-run by c0ffeebabe.eth, a well-known MEV bot operator and whitehat who has in the past been able to front-run other exploits and return the funds to the projects.

About 457.7 ETH ($1.35 million) was drained from the project, but 366.6 ETH ($1.08 million) of that was able to be returned. The remaining ~91 ETH (~$265,000) was lost to validator payments.

Blueberry paused their protocol as they investigated the hack, and stated that they "aim for a full repayment to users as the goal".

DeezNutz_404 hacked for $170,000

I might otherwise skip over news of a $170,000 hack, given how commonly thefts of that scale happen in the crypto world, but with a name like this... come on.

One thing that keeps me from ever trying my hand as a crypto project hacker is that if I made $170,000 from exploiting a project called "DeezNutz_404", I would immediately be caught because I wouldn't be able to resist telling everyone I know that I'd just made enough money to not have to work for a couple years by exploiting deez nuts.

Anyway, there was a bug in their code that allowed an attacker to mint infinite tokens and steal around 58.65 ETH (~$170,000).

Axie Infinity co-founder suffers $9.5 million loss after wallet compromise

Jeff "Jihoz" Zirlin, a co-founder of the Axie Infinity blockchain game, lost around $9.5 million as two of his crypto wallets were compromised. The thief stole 3,248 ETH ($9.5 million), which they quickly laundered with the Tornado Cash cryptocurrency mixer.

Some were briefly concerned that Axie Infinity's Ronin Bridge had been hacked (again), since the funds moved out of the bridge. Jihoz and others were quick to emphasize that the bridge had not been affected, and it was simply a personal wallet compromise.

Influencer "Crypto Rover" accused of pump-and-dump and other shady behavior

Influencer "Crypto Rover" taking a selfie with an exaggerated concerned expression, and the bitcoin logo next to himCrypto Rover (attribution)
A popular cryptocurrency influencer known as "Crypto Rover" has been accused by blockchain sleuth zachxbt of shady behavior, including accepting promotional payments from crypto projects and then not following through on his end of the deal, dumping tokens after promising followers he would hold, and secretly purchasing tokens for memecoin projects before pumping the price by posting about them.

Zachxbt outlined various incidents, including how Crypto Rover purchased "Stoned Pepe" tokens before posting to his hundreds of thousands of followers that he thought the token would "do at least a 10x", and claiming that he had inside info on the project. He also detailed how Rover had taken a $10,000 payment and 1% of the supply of a new token that he promised to promote, then never promoted — despite promising the team that he could "pump projects from 1/2m to 10m easy".

After zachxbt published his research, Rover deleted his Telegram channel.

Over $55 million taken from defunct AAX crypto exchange

The Hong Kong-based AAX cryptocurrency exchange suspended withdrawals in November 2022, only days after the FTX collapse and related chaos in the cryptocurrency world. They claimed that user funds were safe, but the exchange never restored service. A month later, police arrested two of the company's executives.

Now, over a year later, the Cyvers blockchain security firm has observed more than 24,000 ETH (~$55.6 million) has been moved from wallets used by the platform. Although there could be innocuous explanations for money moving off a defunct platform, whoever was moving the funds used various decentralized services to launder the money, appearing to be trying to make it more difficult to trace.

Airdrop hunters spam Github projects

A Github issue titled "github" with the text "i'm a scroll contributor"Airdrop farming Github issue (attribution)
After projects like Celestia and Starknet distributed airdrops of crypto tokens to people who had contributed to their open source Github repositories, airdrop hunters have begun spamming other projects in hope that they might one day receive tokens for their "contributions". In the recent Starknet airdrop, one individual received 1,800 STRK (~$3,200 at current estimates, though the token isn't actively trading yet) for an unmerged pull request fixing a typo in project documentation, so the hope that relatively trivial contributions could result in a windfall isn't completely unjustified.

Several repositories for crypto projects that have not launched tokens were inundated with hundreds of trivial Github issues apparently written in the hopes that in the event of an airdrop, they would be considered contributions.

"Please don't submit a GitHub issue just for farming purposes," wrote one employee of a crypto project receiving such spammy contributions. "The [project] core team is stretched thin enough as it is, please don't make our lives harder." Several projects had to limit who was allowed to open new issues in their repositories to try to tackle the spam.

FixedFloat exchange hacked for $26 million

The FixedFloat cryptocurrency exchange was exploited for around 409 BTC (~$21.17 million) and 1,728 ETH (~$4.85 million) for a total loss of just over $26 million. FixedFloat is a decentralized cryptocurrency exchange that doesn't require user registration or Know Your Customer, making it popular for hackers looking to launder stolen funds.

FixedFloat first wrote that they had "encountered some minor technical problems", then acknowledged that there had been a hack. FixedFloat is non-custodial, so no user funds were impacted, however some have reported frozen transactions and missing funds from using the service on social media.

Yuga Labs acquires Moonbirds amid speculation of insider trading

Pixel art of a white owl with one squinting eye, wearing a forest ranger hat, on a light green backgroundMoonbirds #768 (attribution)
On February 16, the NFT giant Yuga Labs announced it would be acquiring the Moonbirds NFT project. This adds to list of blue-chip NFT collections controlled by Yuga Labs, which already included their original Bored Ape Yacht Club and spin-off NFT collections, and the CryptoPunks and Meebits collections they acquired in March 2022. Decentralized!

Anyway, after the acquisition was announced, prices for Moonbirds spiked, as was to be expected.

What wasn't expected was a notable spike in trading in the days leading up to the acquisition announcement, in which some wallets began accumulating large amounts of Moonbirds and related NFTs. One such wallet purchased 80 Moonbirds, 71 Moonbird Mythics, 28 Oddities, and 13 Mythic eggs in the week leading up to the announcement, and enjoyed several hundred thousand dollars in profits after the acquisition was announced.

Trader loses $4.5 million in phishing attack

A trader known as kirilm.eth fell victim to a phishing attack, losing over 180 million BEAM tokens to a scammer. BEAM is a token belonging to the Beam blockchain gaming network, built by the Merit Circle DAO.

The stolen tokens were notionally priced at around $5.14 million, although the sale of the stolen tokens resulted in a price drop that meant the attacker ultimately was only able to trade them for 1,629 ETH (~$4.5 million). The BEAM price dropped around 10%.

YouTuber KSI accused of pump-and-dump

Crypto sleuths Coffeezilla and zachxbt teamed up on an investigation into YouTuber and crypto promoter KSI, accusing him of pumping up interest into the XCAD project and then dumping tokens priced at $850,000 shortly after, when some of his millions of followers had likely bought in and pumped the price.

Although the token dumping occurred in March 2022, zachxbt waited until now — when KSI returned to his dormant Twitter account — to release the evidence he'd collected.

KSI had previously claimed to followers that he was "holding his bags", meaning not selling the XCAD tokens he'd purchased or been given. zachxbt determined this to have been a lie. The XCAD founder later came to KSI's defense, claiming he had bought more tokens than he sold, as though that somehow justifies the behavior.

"Decentralized" social network Farcaster criticized after confiscating channel name to be used by influential crypto podcasters

Conversation with Dan Romero
Romero
hey there
/bankless wants their channel :)
can I refund you $25 worth of USDC on Base

Sender
Dan with all due respect, bankless is a brand using a common word that has been in our space for a decad
If I was using their logo and perpetrating like I was them, that would be different
This sets a really poor precedent.

Romero
Do you have examples of where you are using Bankless?
happy to be convinced otherwiseConversation between the accused squatter and Farcaster co-founder Dan Romero (attribution)
One of the promises made by proponents of crypto-focused decentralized social networks like Farcaster is that you can't be de-platformed by centralized companies, and you maintain control over your own presence on these platforms.

This made it a bit of a shock when the co-founder of the a16z-backed Farcaster blockchain-based social network messaged a user to inform them that he would be taking away the channel name he had registered, whether he agreed to it or not. According to the co-founder, Dan Romero, the popular Bankless crypto podcast had requested the bankless channel name, which the user he was messaging had already registered.

After the user argued back against Romero's offer of $25 in USDC to reimburse him for the channel name, and said it set a poor precedent, Romero stated: "ok this isn't productive. do you want USDC for the refund or warps" (referring to the non-crypto points used by the Warpcast client for Farcaster).

On one hand, some criticized the user who had registered the name for allegedly squatting on the channel name and trying to resell it. Romero defended his decision by arguing, "I never said channels were decentralized yet" (though the platform does generally claim to be "sufficiently decentralized"). Others argued the action set a bad precedent, and flew in the face of the ethos supposedly motivating these types of web3 social networks.

Romero has promised on Twitter that Farcaster channels "will be onchain later this year and like [user identifiers] won't be able to be touched." When pushed on the precedent this sets, he replied, "So let the squatter extort money?" Romero clearly needs to grapple with the fact that, like it or not, squatting is a feature of systems that take a hands-off approach to managing access to identifiers. This should not be news to anyone remotely familiar with the web, where "domaining" emerged out of the relatively laissez-faire structure of DNS — though unlike with fully decentralized identifiers, there can be some intervention when domain name speculation enters the realm of cybersquatting.

Creator of "Robotos" NFT project, once collaborating on a TV series with TIME studios, accused of rug pull

A doodle of a robot with a gold crown, a blue suit jacket over a white shirt and black tie, and pink eyesRoboto #2767 (attribution)
Pablo Stanley, an artist who created the "Robotos" generative NFT collection, posted two final messages from the Robotos Twitter account. First, "it was a good run! thank u, all!", then an image of the Twitter log-out button with "forever and ever".

Rewind to November 2021, when it was announced that TIME Magazine's film and production studio would be collaborating with Stanley to develop a children's animated TV show based on the Robotos NFTs. The announcement helped to drive interest in the NFT collection, which reached a peak floor price of around 1.5 ETH (~$5,000 at the time).

Since then, no show has materialized, and the collection's floor price has dwindled. NFTs from the collection have recently sold for around 0.015 ETH (~$42). In the project Discord, Stanley claimed that TIME had lost interest in the project after the writer's strike. He also wrote that he had lost faith in web3: "Glad you still believe. It's hard for me to believe in it anymore." He explained that he had viewed Robotos as a "personal side project", and that he was "sorry if that's not enough for most people, but that's all I have the appetite for, and that's all I can offer."

Duelbits crypto casino exploited for $4.6 million

The Duelbits crypto casino and sports betting website was drained of around $4.6 million on both the Ethereum and BNB Chain blockchains. The funds were quickly bridged or exchanged to ETH.

It appears that the thief got access to a Duelbits wallet, perhaps through a private key compromise.

Yuga Labs bungles "free" Otherside NFT drop

An illustration of a grey cylinder, seemingly made from stone, with glowing gold light inside it appearing through some cracks and designsyuga-ship-part (attribution)
Some fans of Yuga Labs (the company behind Bored Apes and the much-anticipated Otherside metaverse gaming project) are questioning how much progress the company can really have made on the as-yet-unreleased flagship Otherside gaming project, if they managed to screw up an NFT design this badly.

Yuga released a new NFT, intending to function as ship parts that could be combined to create a ship to be used in the game. Players who had completed an Otherside minigame would be eligible to mint these NFTs for free. However, the "free" NFT cost around $30 in gas fees to mint. Worse still, the parts were meant to be repeatedly traded and combined to make new parts and ships, leading fans to wonder why on earth they decided to release the project on a blockchain where each transaction often costs tens of dollars.

Apparently realizing they'd made a mistake, Yuga first responded by announcing they would gift people free "Catalyst" NFTs to make it up to them. This only sparked further rage, though, as it was seen to dilute the value of the Catalyst NFTs and throw off incentives.

Yuga later reversed course on this decision, instead deciding to reimburse the gas fees.

This was not Yuga Labs' first gas-related fiasco, after they caused gas fees to spike into the thousands of dollars across the entire Ethereum network in April 2022 during the initial Otherside land sale.

One observer wrote, "[W]hat's the plan for the marketplace in Otherside that is supposed to support millions of daily microtransaction? I'm afraid this means Otherside is much less developed than we would like to hope. These decisions are entry level mistakes, not mistakes we should see from the biggest company in the space developing a metaverse. If the Otherside mint wasn't an eye opener, then this wont be either."

PlayDapp crypto gaming platform exploited, spurring misleading headlines

The South Korean blockchain gaming platform PlayDapp was hacked on February 9, and an attacker minted 200 million $PLA tokens. These were notionally priced at around $36.5 million, although because only 577 million $PLA were in circulation before the unauthorized mint, there would not have been sufficient liquidity for the attacker to sell them at around that price.

Days after the initial attack, on February 12, the attacker minted another 1.59 billion $PLA. This has led to news reports that the platform was exploited for "$290 million". However, this value is being naively calculated based on the token price without taking into account the massive supply inflation, and ignoring that that dollar figure is more than 2.5x the total claimed market cap of the token. Even reputable outlets like Bleeping Computer have printed the figure in their headline (though Bleeping Computer later changed the headline to a more accurate one).

PlayDapp sent on-chain messages to the attacker, offering a bounty, but the offer was ignored.

Solana goes down for five hours

They were doing so well! After suffering a slew of outages during 2022, Solana had seemed to get their act together in 2023 with only one major outage. Now, however, Solana has gone offline again for five hours.

With blockchains promising to become "world computers" upon which anyone can create projects ranging from mere toys to critical infrastructure, uptime is crucial, and a five-hour-long outage is devastating.

SIM swappers charged over hacks, reportedly including FTX

Three people running a SIM swapping operation have been charged with fraud and identity theft. By gaining access to the personal information of their victims and then convincing cell phone providers to "swap" victims' phone numbers to phones they controlled, they were then able to gain access to various accounts controlled by their victims.

Although the indictment does not name FTX, Bloomberg has reported that "victim company-1" named in the court filings was FTX, which was hacked for around $400 million amid the chaos as the company was collapsing.

Crypto exchange created by Three Arrows Capital founders to shut down

Who can believe this. OPNX, the crypto derivatives exchange created by the people who ran and then blew up the Three Arrows Capital hedge fund, will be shutting down. The exchange was originally announced in January 2023, with a tentative name of "GTX" — "because G comes after F", they said. It was created as an evolution of the CoinFLEX exchange, which had become insolvent and halted withdrawals in June 2022. Much of the exchange's focus was on allowing creditors of bankrupt cryptocurrency projects to trade their claims — including claims on Three Arrows Capital.

Now, as Su Zhu emerges from several months in jail, he, Kyle Davies, and the other executives of OPNX are shutting down the project. Traders have a week to settle their positions, and another week before the platform closes entirely.

Both Zhu and Davies are, of course, trying to promote a new crypto derivatives trading project.

More than $58 million stolen in Twitter phishing schemes in January

Scam Sniffer's January 2024 report describes more than 40,000 victims who collectively lost more than $58 million thanks to various phishing schemes on the Twitter platform.

The top seven victims collectively lost $17 million, with the top victim alone losing $4.7 million.

$112.5 million in XRP stolen from Ripple CEO Chris Larsen

Chris LarsenChris Larsen (attribution)
Blockchain sleuth zachxbt noticed the strange movement of around 213 million XRP, the native token for the Ripple project. These tokens were priced at around $112.5 million at the time of the theft. He originally identified the source of funds as Ripple itself, though Ripple CEO Chris Larsen later went on Twitter to claim that the funds that were stolen had come from his personal wallets and not from wallets belonging to the Ripple project.

Larsen attempted to downplay the massive theft, claiming repeatedly that the theft did not represent a threat to Ripple itself, and trying to reassure people that Ripple wallets are still safe. However, fears over a threat to Ripple itself and the true separation between Larsen's wallets and those belonging to the Ripple project continued, and XRP dipped around 5% on the news.

Abracadabra exploited for almost $6.5 million, Magic Internet Money stablecoin depegs

Well that sure is a headline I just had to write.

The Magic Internet Money ($MIM) stablecoin has lost its dollar peg again, dipping all the way below $0.77 in a flash crash before returning to around $0.95.

The depeg appears to be related to an exploit of the Abracadabra lending protocol, which allows people to borrow $MIM. An attacker exploited an apparent flaw in the platform's smart contracts to drain around $6.5 million.

This is the second time the token has depegged, after a June 2022 incident shortly after the Terra collapse.

HyperVerse founder Sam Lee charged

US Attorneys in Maryland and the US Securities and Exchange Commission filed criminal and civil lawsuits, respectively, against Sam Lee, the co-founder of the HyperVerse cryptocurrency investment scheme, which has defrauded victims of between $1.3 billion and $1.9 billion depending on whose estimate you use. The US Attorneys have accused Lee of securities fraud and wire fraud. The SEC has accused Lee and a major HyperVerse promoter, Brenda Indah Chunga (aka "Bitcoin Beautee"), of securities fraud and offering unregistered securities.

This is the second HyperVerse related criminal charge in recent days, following the arrest of promoter "Bitcoin Rodney".

Goledo Finance hacked for $1.7 million

Goledo Finance, an Aave-based lending protocol, was exploited through a flash loan attack. The attacker stole assets estimated by CertiK at around $1.7 million.

Goledo Finance contacted the attacker to offer a 10% "bounty" for the return of the remaining assets. In a message on January 29, the attacker wrote: "I hacked Goledo and want to negotiate".

Korean crypto karaoke platform Somesing hacked

Have you ever gone out to karaoke and thought "man, the only thing missing from this perfect night is a blockchain"? No? Weird.

Anyway, the South Korean Somesing platform — which is really more of a TikTok-but-just-for-song-covers clone than anything to do with karaoke — suffered a breach in which 730 million SSX tokens were stolen. These tokens are nominally priced at around $11.5 million, but around 2/3 of the stolen tokens were as yet undistributed and not a part of the circulating supply.

8,100 Bitcoin forfeited by Silk Road drugs distributor in guilty plea

The US government is cementing its status as one of the largest BTC holders by adding another 8,100 BTC (priced at almost $350 million today) to its stash. The tokens were forfeited in a plea agreement from Banmeet Singh, who sold large quantities of drugs including fentanyl, LSD, ecstasy, Xanax, Ketamine and Tramadol on various dark web marketplaces including the Silk Road.

Singh pled guilty to conspiracy to possess with the intent to distribute controlled substances and conspiracy to commit money laundering, charges for which he's expected to serve around 8 years in prison.

WallStreetMemes token price plummets after staking contract exploited

Hackers were able to exploit a vulnerability in the staking contract for WallStreetMemes ($WSM), a memecoin and online casino project targeted at the "meme warriors" who frequent various financial meme communities, many of which formed around the Gamestop short squeeze.

The attackers were able to siphon 769 million $WSM from the contract, which was notionally worth around $7 million. However, the token lacks liquidity to support swapping hundreds of millions of tokens without depressing the price, and the token price dropped around 35% in the wake of the attack as the thief began to cash out over several days.

Meanwhile, WSM announced that they would be issuing a new token to replace the stolen tokens, and "renew[ing] the liquidity pool"... somehow.

MailerLite hack enables over $700,000 in crypto phishing thefts

A phishing email appearing to come from WalletConnect: "You're invited!
We hope this email finds you well and thriving in the world of decentralized finance! Today, we're thrilled to bring you an exclusive celebration that promises to elevate your crypto experience to new heights.
This is not just another airdrop; it's a rare opportunity to amplify your crypto portfolio and be part of something extraordinary. The team at WalletConnect, in collaboration with Web3Inbox, is hosting a special occasion to express our gratitude to our valued users and community members."WalletConnect phishing email (attribution)
After hackers gained access to various accounts on the MailerLite email marketing software via a social engineering attack on an employee, they were able to send malicious phishing emails that appeared as though they had been genuinely sent from companies including the CoinTelegraph crypto media outlet and the crypto firms Wallet Connect, Token Terminal, SocialFi, and De.Fi.

The emails appeared to announce airdrops and exclusive offers from those companies, and recipients were invited to connect their wallets to claim tokens. Those wallets were then drained.

The attackers stole a variety of cryptocurrencies, and some outlets have reported the theft has totalled more than $3.3 million. However, because a substantial amount of that number comes from the illiquid Xbanking token, the actual liquid value of the tokens is likely closer to $700,000. The attackers have begun mixing the stolen funds through the Railgun privacy service.

Animoca Brands-owned Gamee tokens stolen

An attacker was able to gain access to the Gamee (GMEE) token's source code repository, then exploit a vulnerability in the code to transfer 600 million GMEE tokens to their own wallets. At the token's market price of $0.025 before the hack, these tokens were ostensibly priced at $15 million, though the token value plunged around 60% to below $0.01 following the theft as the attacker began selling the tokens.

GMEE is the token belonging to the Gamee blockchain-based gaming platform, which was acquired by the Animoca Brands company in 2020. Animoca is mostly known for its crypto-metaverse project, The Sandbox.

Concentric Finance exploited for $1.8 million

The Concentric Finance yield aggregator project issued a statement that the protocol had been exploited after a social engineering attack on a team member that had access to the project's deployer wallet.

Tokens priced at around $1.8 million were drained from the project vaults. In a tweet, Concentric urged users to revoke contract approvals to avoid further losses.

The wallet addresses used by the exploiter appeared to connect the attacker to the $2.7 million OKX DEX theft in December 2023.

Terraform Labs files for bankruptcy

Terraform Labs, the company behind the Terra blockchain, has filed for bankruptcy. Its flagship product, the Terra stablecoin and associated LUNA token, failed spectacularly in May 2022. Its CEO, Do Kwon, was arrested in March 2023, and remains in custody awaiting a decision on whether he will be extradited to the United States or South Korea — both of which are looking to charge him over his role in the scheme.

Despite all of that, Terraform Labs had continued to operate. However, it is now in dire financial straits, and has now filed for Chapter 11 bankruptcy in an attempt to sort out its financial obligations amid costly legal cases. Terraform Labs is currently a defendant in a complaint by the SEC, as well as several class-action lawsuits.

According to the company's bankruptcy filing, it has between $100 million and $500 million in assets, and liabilities in the same range.

Dwight Howard's NFT project flops

An illustration of Dwight Howard in 3/4 profile, wearing shades with "Ballers" across the front in LEDs, and a tank top with the Avalanche logo pinned on a strapBallers NFT project artwork (attribution)
NBA star Dwight Howard is clearly at least a year (probably two) late to the time when celebrities and star athletes could drop some low-effort NFTs and sell out the whole batch immediately. After announcing his "Ballers" project on January 20, offering 3,000 NFTs for a mint price of 2 AVAX (~$60) apiece, he only managed to sell about 300 of them within a day or so.

After the dismal launch, Howard tried a few somewhat desperate-seeming moves to try to attract interest in the project: promising to send free crypto to some holders, redoing all the art after criticism of its quality, and slashing the NFT supply to 1,500. Despite all that, only 465 NFTs have sold (15% of the original supply, netting Howard 930 AVAX — around $28,400).

The flop was so bad that a member of the team behind the Avalanche blockchain put out a tweet distancing themselves from the project, stating that they didn't even know about the project until he announced it. "Gone are the days that individuals/Brands with large followings can just drop IP related NFTs out of nowhere and expect it to do well," they wrote, seemingly criticizing Howard's approach by writing that NFT creators must "mak[e] sure to do it in an organic way with proper intentions."

CFTC files complaint against Debiex platform for using "romance scam tactics" to steal $2.3 million

The CFTC has filed a complaint against Debiex, a shadowy cryptocurrency platform whose precise location and executives are unknown. The company's employees primarily targeted Chinese Americans, and used common romance scam techniques: first striking up a friendship or romantic relationship with the victim, then convincing them that they could earn huge profits by putting money on Debiex.

Debiex, however, only resembled a cryptocurrency trading platform. In reality, the website merely mimicked a trading platform, and the funds supposedly deposited there for trading purposes were taken by Debiex.

The CFTC identified five victims who were allegedly defrauded of a combined $2.3 million.

Colorado pastor charged for cryptocurrency scam he says he perpetrated at God's command

A still frame from a video of a man speaking to a camera, with the subtitles: "So the charges are that Kaitlyn and I pocketed $1.3 million and I just want to come out and say that those uh charges are true."Eli Regalado (attribution)
A Colorado-based pastor for an online ministry sold INDXcoin to his followers and others in the Christian faith. However, there was no way for buyers to cash out the tokens. Meanwhile, Regalado and his wife spent the money on a Rolls Royce, jewelry, and designer handbags — and, according to Regalado, "a home renovation the Lord told us to do."

Regalado posted a video to his supporters explaining that he had been sued by the Colorado state securities regulator. "So the charges are that Kaitlyn and I pocketed $1.3 million, and I just want to come out and say that those uh charges are true," said Regalado in the video, presumably causing a cold chill to run down the spine of his defense attorney in the middle of whatever he was doing.

According to Regalado, God told them to first invest in a separate coin, which turned out to be a scam. Then, says Regalado, God told him to make his own currency, which Regalado called INDXcoin, "but also give them a 10x". Who knew God was a degen! Regalado had told investors that the funds would be going to "widows and orphans", but spent most of it on himself and his wife.

Luis Rubiales' NFT launch condemns "radicalism and feminist extremism" and describes alleged assault as "a small mistake"

Luis RubialesLuis Rubiales (attribution)
Apparently, former president of the Royal Spanish Football Federation Luis Rubiales has decided the way to rehabilitate his reputation after forcibly kissing a soccer player and being banned from football is to... release an NFT project.

In an announcement posted on Rubiales' Twitter account, the South Korean Moon Labs wrote: "Yes, we agree that Mr. Luis Rubiales made a small mistake in women world cup." The statement went on to condemn "extremism and radical feminism", and downplay Rubiales' actions as not "really" sexual assault. "Yes, Luis did small mistake but probably the biggest mistake was losing Luis Rubiales in football part [sic]."

$2.7 million disappears from funds meant to compensate Hector Network investors

In July 2023, angry investors in the Hector Network project opted to "rage quit" — an option reserved by some defi projects that allows investors to vote to liquidate a project's remaining treasury and distribute it to token holders. The successful rage-quit vote in Hector's case came after the protocol lost $8 million in the Multichain disaster, although investors say that was only the final straw in a series of poor management choices and inflated salaries that saw the project treasury dwindle from over $100 million to around $16 million.

Now, another $2.7 million is gone after an apparent thief was able to exploit a smart contract that was intended to distribute payouts to Hector's token holders. They then swapped the tokens from the USDC stablecoin to ETH.

Investors in the project are furious, especially because various parties had warned Hector Network about apparently insecure practices. Hector Network's team, meanwhile, have not acknowledged the theft, although a law firm involved in the project liquidation promised a statement would be forthcoming.

TrueUSD loses peg (again) as traders sell due to fears over its stability

TrueUSD, a stablecoin connected to Justin Sun, deviated from its intended $1 peg to around $0.983 as traders sold off more than $100 million of the token seeking safer options. The fears seemed to be sparked by the rapidfire and massive hacks of the Justin Sun-connected HTX (hacked for $115 million) and Poloniex (hacked for $120 million) in November.

Adding to those is the fact that TrueUSD recently paused its real-time reserves attestations, due to systems reporting liabilities that exceeded assets, though TrueUSD (obviously) claimed this was just an error.