Onyx apparently didn't learn their lesson the first time around, when they were exploited for $2 million in November 2023 by an attacker taking advantage of a known vulnerability affecting empty markets on the protocol. This same bug seems to have contributed to this exploit, although Onyx has claimed the hack was due to a separate vulnerability in an NFT liquidation contract.
Onyx hacked for $3.8 million via the same exploit used against them less than a year ago
Truflation hacked for around $5 million
Truflation is a blockchain-based project that provides economic data including inflation rates and asset valuations. The platform has been backed by Coinbase Ventures, Chainlink, and others.
OpenAI Twitter account once again hacked and used to promote scam token
This latest hack is only the latest in a slew of Twitter account compromises "announcing" a scam token. Over a year, OpenAI CTO Mira Murati had her account hacked to promote an "$OPENAI" token. Three months ago, accounts belonging to chief scientist Jakub Pachocki and researcher Jason Wei were hacked and used to post the same scam as today.
Shezmu hacked for almost $5 million, negotiates bounty
Shortly after the attack, Shezmu offered a 10% "bounty" for the return of the funds. The attacker responded that they would only consider a 20% bounty. Shezmu agreed to the terms, and announced to their followers that they had achieved a recovery from the "white hat" hacker.
BingX hacked for $52 million
Some accused the exchange of trying to cover up the theft by announcing "temporary wallet maintenance" without disclosing that a theft had occurred. The team later announced that "there has been minor asset loss", and stated that the lost funds would be restored out of the company's capital.
Around $10 million of the stolen assets were frozen during recovery efforts after the theft.
Germany seizes 47 cryptocurrency exchanges reportedly used by ransomware groups
Websites for these exchanges now show notices announcing a law enforcement operation called "Operation Final Exchange". The page announces to visitors "This was your final exchange!", and in a letter addressed to "ransomware affiliates, botnet operators and darknet vendors", warns that authorities are now working to trace the illicit users of the exchange.
- "Germany seizes 47 crypto exchanges used by ransomware gangs", BleepingComputer
Almost $2 million taken from users of Telegram "Banana Gun" crypto trading bot
Banana Gun acknowledged the attack on Twitter and shut down the bot. They posted that they did not believe their backend was compromised, and stated that they believed the attack occurred via a "front-end vulnerability" — though it was not clear what this might have referred to.
- "Telegram bot Banana Gun’s users drained of over $1.9M", CoinTelegraph [archive]
Arrests made after $243 million stolen from one individual in Gemini phishing attack
The FBI raided a luxury home in Miami in connection to the theft, and arrested two men in their early twenties. Authorities worked with crypto investigators including zachxbt to trace the stolen funds.
Rari Capital settles with the SEC
The company and co-founders will pay fines, and the individuals will agree to five-year bans from serving as officers or directors.
The regional SEC director stated, "We will not be deterred by someone labeling a product as 'decentralized' and 'autonomous'," alluding to crypto firms' tendencies to try to skirt securities regulations by claiming to be "decentralized".
Rari has featured on Web3 is Going Just Great before, when they were exploited for around $80 million in April 2022 and when they were exploited for around $15 million in May 2021. The project effectively wound down soon after the second theft.
- "SEC Charges DeFi Platform Rari Capital and its Founders With Misleading Investors and Acting as Unregistered Brokers", U.S. Securities and Exchange Commission [archive]
Ethena website compromised
They later were able to deactivate the website and regain control of the domain. "Remember scammers are always chasing you," they wrote on Twitter.
$6 million taken from Delta Prime defi protocol
DeltaPrime acknowledged the attack on Twitter, and announced that "the risk is contained". They also stated that they were "looking into other ways to reduce user losses to a minimum", including by pulling from the protocol's insurance pool.
Flappy Bird creator disavows crypto spin-off
Nguyen famously removed the game from app stores shortly after it surged to popularity, stating that he felt guilty that people were becoming addicted to the game. This makes the game's reappearance — complete with loot boxes and other addictive features — feel somewhat dark.
On September 15, Nguyen returned from a seven-year Twitter hiatus to post: "No, I have no related with their game. I did not sell anything. I also don't support crypto."
Although Nguyen held the Flappy Bird trademark, he did not sell it to this group. Instead, they registered the trademark themselves after arguing he had abandoned it.
Eve Online developer angers fans with announcement that their new game will be blockchain-based
"There is still time. You can still roll it back and pretend it never happened. Please. None of us want this crypto slop, this desperate cash grab, this attempt at 'creating something great,' this game where buzzwords seem more important than gameplay," wrote one player on the game's subreddit.
A tweet announcing the game was celebrated by some crypto advocates, but attracted some critical responses from players. One wrote, "releasing a blockchain game a year after the weird hype about that technology died so now you got a shitty concept and don't even get a pay-off for it. let's see how this is going to turn out :)"
eToro settles with SEC for $1.5 million, shuts down most crypto trading
- “eToro Reaches Settlement with SEC and Will Cease Trading Activity in Nearly All Crypto Assets”, United States Securities and Exchange Commission [archive]
Adam Neumann's Flowcarbon refunds customers after failing to launch "Goddess Nature Token"
Now, Flowcarbon has reportedly been issuing refunds after the tokens have failed to materialize more than two years later. Flowcarbon has reportedly been blaming "market conditions and resistance from carbon registries" for the failure to launch, according to a report from Forbes. Flowcarbon claimed they have been offering refunds "due to industry delays" since 2023.
CryptoPunk sells for a fraction of its likely market price due to zombie smart contract
The platform's smart contracts remain operational, however, and so despite the lack of a frontend website for the platform, the backend still remains. A trader was able to use these smart contracts to trigger a feature that allows a buyout of the fractional shard holders which, if not countered by someone else, automatically goes through in 14 days. The bidder proposed a purchase of 0.001 ETH per share, and without an operational Niftex frontend, no one noticed. The bid went through, and the trader successfully purchased all 10,000 shares — and thus, the NFT — for 10 ETH.
Since then, several people have offered to purchase the NFT for amounts ranging from 100 to 605 ETH. If the new owner were to accept the 605 ETH bid, they would 60x their purchase price.
One owner of a fractionalized share said he thought he had managed to successfully block the sale, but miscalculated. "GG to the new owner", he wrote. He wrote on Twitter, "I don’t consider this a heist. It’s an arb. The smart contract worked as intended. If you want decentralized systems you have to take the good with the bad. It’s part of the game. It’s why we’re here. If you don’t like those rules, you probably shouldn’t be playing."
Hacker steals $1.45 million from CUT token liquidity pool
Indodax crypto exchange apparently hacked for at least $22 million
Indodax's Instagram account also appeared to be compromised, promoting a suspicious "giveaway".
State securities regulators settle with GS Partners over pyramid schemes including "tokenized skyscraper"
Terms of the settlement include 100% repayment of investments made by victims in the five states that settled: Texas, Alabama, Arizona, Arkansas, and Georgia.
GS Partners has also faced regulatory scrutiny in other US states, as well as in Canada, Australia, and South Africa.
AssangeDAO accused of rug pull after transferring treasury to German foundation
This $10 million was later sent to a German non-profit foundation called the Wau Holland Foundation, which has also been fundraising and managing funds relating to Assange's legal defense. However, this transfer raised serious concerns among some members of the DAO who say they've effectively been cut out of decisionmaking, that the funds were transferred without their approval, and allege the treasury was mismanaged and crashed in value as a result.
Hacktivist, bitcoin core developer, and AssangeDAO organizer Amir Taaki accused fellow AssangeDAO organizer: "Harry Halpin you should be honest and direct with the people here. You believe the money should be kept in a foundation controlled by your people with Julian. You do not respect the community or believe in the DAO."
Friend.tech team abandons project
The project spiked in popularity when it launched in August 2023, but interest rapidly dwindled. A token launched in May 2024 also suffered a mostly downward trajectory. On September 7, the team reassigned ownership and admin rights to the smart contracts to the burn address, making them permanently inaccessible.
Some denounced the project as a Ponzi scheme (repeating accusations it has received since its inception, based on its incentive structure). Others accused the development team of rug pulling and not delivering on their promises — accusations that intensified as one co-founder deleted his Twitter account and the other set his to private. The team is estimated to have made around $44 to $60 million in fees.
Revelo CEO resigns after claiming he was robbed of personal and company funds at gunpoint
He went on to state that the "vast majority" of the stolen assets were his personal funds. He also alleged that "There is some evidence to suggest that someone in the Ventures syndicate is either part of the group, or passing information onto them."
The amount of funds stolen was not disclosed. Drakon resigned as CEO, and said that he had forfeited his interest in Revolo Intel "to facilitate the return of some money back to members as quickly as possible". He wrote: "To be clear, I have zero financial interest in Revelo moving forward."
He also stated that he would be "stepping away from 'public life' in this space", and warned others: "If you are someone who is known to control large sums of money, you are a target and it is not difficult at all to get to you."
Robinhood pays $3.9 million to settle commodities law violations in California
In addition to the fine, terms of the settlement require the platform to allow its customers to withdraw their crypto assets, and to update disclosures regarding asset custody.
The California DOJ also accused the platform of misleading its customers by claiming that the app "advertis[ed] it would connect to multiple trading venues, to ensure customers receive the most competitive prices between the venues, which was not always true". They also say that Robinhood lied about always holding all customer crypto assets purchased through the platform, when in reality, "there were instances in which it arranged for trading venues to hold customer assets for extended periods".
- "Attorney General Bonta Secures $3.9 Million Settlement with Cryptocurrency Company Robinhood", California Attorney General's Office [archive]
Trump family Twitter accounts compromised ahead of World Liberty Financial launch
The posts were deleted and accounts were locked down very quickly by Twitter, but not before approximately 2,000 people bought around $1.8 million of the fake token.
Penpie hacked for $27.3 million
The team behind Pendle (the platform on which Pendie is built) detected the attack and paused Pendle an hour after the attack began, which they claim prevented another $105 million from being stolen.
Members of the Penpie team filed complaints with Singaporean police and the US FBI. They also attempted to negotiate a "bug bounty" via on-chain and social media messages to the attacker, but the hacker seems uninterested and has continued to transfer funds between various crypto wallets and launder funds through Tornado Cash.
SEC charges Galois Capital, Galois settles
The SEC also charged that Galois Capital had misled some investors into believing they needed five business days of notice to redeem assets, while other investors were allowed to redeem assets more quickly.
Galois agreed to a settlement with the SEC in which they will pay a $225,000 penalty, which will go to investors who lost money.
- "SEC Charges Crypto-Focused Advisory Firm Galois Capital for Custody Failures", U.S. Securities and Exchange Commission
"Peripheral" Aave smart contract hacked for $56,000
An exploiter was able to take advantage of an arbitrary call error that allowed them to steal funds from these various contracts, amounting to around $56,000. Various people associated with Aave emphasized that there was no risk to user funds or flaw in the core Aave protocol, and one described the hack as "raiding the tip jar".
OpenSea receives SEC Wells notice
Finzer promised that the company would vigorously fight any impending lawsuit.
The lawsuit echoes previous enforcement actions by the SEC, such as a September 2023 settlement with the celebrity-backed Stoner Cats project, in which the SEC suggested that it may broadly view NFTs as securities if investors "reasonably expect to profit" from the continued efforts of those who release the NFTs.
Bitcoin mining company Rhodium Enterprises files for bankruptcy
Bitcoin mining has been an extremely challenging business in recent times, partly due to volatile crypto prices over the last few years, and due to diminishing miner rewards following the April halving event.
Rhodium Enterprises had been showing signs of trouble, including failing to make scheduled loan payments earlier this month. In December 2023, a dispute between them and a subsidiary of the Riot Platforms bitcoin mining group culminated in armed security removing Rhodium employees from a bitcoin mining facility in Rockdale, Texas, where Rhodium was leasing bitcoin miners. The case was later sent to arbitration.
Brothers charged by SEC for $60 million "crypto bot" Ponzi scheme
However, $53.9 million of investor funds were used to pay other investors, in classic Ponzi fashion. The brothers also used investor funds to build houses for themselves and their family, purchase vehicles and designer goods, and make payments on a $30 million condo in Miami for Tanner.
One of the brothers, Jonathan, had in 2004 been convicted on felony securities law violations that resulted in a four-year jail sentence and more than $300,000 in restitution.
- "SEC Charges Brothers Jonathan and Tanner Adam with $60 Million Ponzi Scheme", U.S. Securities and Exchange Commission [archive]
Abra crypto lender charged with securities violations, settles
Abra settled the charges from the SEC by agreeing to an obey-the-law injunction, and agreeing to pay as-yet-undetermined civil penalties.
In January 2024, Abra settled claims from the Texas State Securities Board by agreeing to refund customers. As a part of the complaint, the TSSB had alleged that Abra was "insolvent or nearly insolvent", and had been making misleading statements. In June 2024, Abra settled with 25 state regulatory agencies, agreeing to refund up to $82.1 million to its US customers. Abra had begun winding down operations in the United States in mid-2023, after facing multiple state regulatory actions.
- "SEC Charges Abra with Unregistered Offers and Sales of Crypto Asset Securities", U.S. Securities and Exchange Commission [archive]
- "Crypto firm Abra reaches settlement with US states for operating without licenses", Reuters
Users suffer losses after Polygon Discord hack
One member of the Discord described losing more than $140,000 in tokens after clicking a link shared by a person appearing to be a member of the Polygon team, which advertised a token distribution to serve as a "pre-migration celebration".
McDonald's Instagram hacked, hackers claim $700,000 haul
They then boasted about their haul on the compromised Instagram account, changing the bio to say: "Sorry mah nigga you have just been rug pulled by India_X_Kr3w thank you for the $700,000 in Solana 🇮🇳".
The token stunt by the massive company was perhaps made more believable by McDonald's previous forays into crypto, including when they launched a McRib-themed NFT project in December 2021. The company had also joked about a "Grimacecoin" back in January 2022, in a reply to a tweet from Elon Musk.
Crypto holder loses over $55 million to apparent phishing attack
The attacker later moved the stablecoins to a new wallet, and exchanged about half of them for 10,625 ETH.
Former CEO of Heartland Tri-State Bank sentenced to more than 24 years in prison after putting bank funds into crypto scheme
Between May and July of 2023, Hanes transferred $47.1 million of the bank's funds to the fraudulent scheme. This ultimately led to the bank collapsing, with equity investors losing $9 million and the FDIC footing the bill. "There were people who lost 70, 80% of their retirement" as a result of their investment losses, stated a community member.
Hanes had also taken money from a local church, an investment club, and his daughter's college savings. These funds were reportedly used to buy cryptocurrency after those running the scheme told him they needed more money to "unlock" the returns on his investments — a common tactic with these scams.
- "Former CEO of failed bank sentenced to prison", U.S. Attorney's Office, District of Kansas [archive]
- "Cryptocurrency 'pig butchering' scam wrecks Kansas bank, sends ex-CEO to prison for 24 years", NBC News [archive]
FutureNet founder arrested for alleged crypto fraud
Ziemian was wanted on international warrants from Poland and South Korea. FutureNet, which was established in 2018 and purported to be a crypto trading platform, is alleged to have defrauded numerous people of a combined $21 million. Victims were encouraged to buy "participation packages", and earn rewards for referring others to the scheme. Polish authorities warned that FutureNet might be a pyramid scheme in 2019, and South Korea began an investigation into the company in 2020.
Ziemian faces fraud, money laundering, and theft charges, which could be punished by life imprisonment in South Korea.
- "U Podgorici uhapšeno međunarodno traženo lice koje se sumnjiči za višemilionske prevare", Vlada Crne Gore (in Montenegrin) [archive]
- "Co-founder of crypto fraud scheme FutureNet arrested in Montenegro", ReadWrite [archive]
Twitch streamer DNP3 pleads guilty to wire fraud after gambling away funds invested in crypto charity project
Now, Austin "DNP3" Taylor has pleaded guilty to wire fraud after stealing around $1.14 million in investor funds from his CluCoin project, which had claimed it would "help others in need". DNP3 himself had built up a reputation of making generous gifts while livestreaming. He transferred the stolen funds to online casinos, where he then gambled them away.
Taylor faces up to 20 years in prison. The statement from the U.S. Attorney's Office announced that authorities would be notifying identified victims via NFT, and encouraging them to submit statements to the FBI.
- "Founder of Miami-Based Cryptocurrency Token CluCoin Pleads Guilty to Wire Fraud", U.S. Attorney's Office, Southern District of Florida [archive]
Crypto holder loses $100,000 to "Coinbase support" scammer, found via a Google ad
Scammers impersonating crypto company support representatives are everywhere on social media and elsewhere. Now, it seems, they are purchasing Google ads to rise to the top of Google search rankings. While Google says they attempt to remove fraudulent advertisers, some slip through the cracks.
While phishing attacks like this are prevalent both in crypto and in tradfi, crypto platforms often do not have similar safeguards as major banking platforms to try to thwart unauthorized transactions, nor do they have the same ability to reverse transactions that are made.
SEC charges promoters of NovaTech pyramid scheme
The SEC's lawsuit also targets six other promoters of the NovaTech scheme, all of whom the agency says used "religious overtones" when attracting new investors. Ultimately, the scheme was revealed to be a Ponzi scheme, with new investors' money being used to pay out previous investors, as the promoters also took money for themselves.
- "SEC Charges NovaTech and its Principals and Promoters with $650 Million Crypto Fraud", US Securities and Exchange Commission [archive]
FTX settles complaint from the CFTC with $12.7 billion payout
Defendants Sam Bankman-Fried, Caroline Ellison, and Gary Wang, as well as the FTX and Alameda Research companies, will be prohibited from commodities trading, including trading bitcoin, ether, USDT, or other assets considered "digital asset commodities" by the CFTC. However, with Bankman-Fried already beginning a 25-year prison sentence, and Ellison and Wang due to be sentenced, this may be low on their list of worries.
- "Judge approves $12.7 billion settlement between FTX and CFTC, bringing 20-month-long lawsuit to an end", The Block [archive]
- Permanent injunction, document #44 in CFTC v. Bankman-Fried [archive]
North Korean developers steal $1.3 million from crypto project treasury
zachxbt traced the payment addresses for roughly 21 developers involved in this kind of activity, which he found had been working for at least 25 different cryptocurrency projects. They had earned around $375,000 over the past month.
Ripple fined $125 million by the SEC
Ripple and others in the crypto world have been celebrating the judgment as a victory, in part because it is a substantially smaller penalty than the $1 billion in disgorgement and $900 million in penalties sought by the agency.
The SEC has already signaled throughout the case that they were likely to appeal an eventual outcome, after objecting to the judge's decision that several other types of token sales were not unlawful securities offerings.
Trump-themed $DJT token rug-pulls, people blame Martin Shkreli or Barron Trump
People were quick to blame those behind the project, primarily "Pharma Bro" Martin Shkreli (who has been accused of dumping his own token before). Shkreli was quick to shift the blame to Donald Trump's youngest son, Barron, who he has also claimed is behind the token (although this has not been independently confirmed). However, the owner of the wallet that dumped its tokens is not definitively known.
$12 million taken by whitehats from Ronin bridge
Fortunately for the Ronin team, it seems that most of the losses actually went to whitehats and MEV bots that were frontrunning transactions by would-be exploiters. ETH and USDC priced at around $12 million were taken — the maximum amount before triggering a safety feature in the code. Later that day, Ronin announced that the ETH (worth around $10 million) had been returned, and that the USDC was in the process of being returned. They also announced that they would reward the whitehats with a $500,000 bug bounty reward.
The Ronin bridge was taken offline shortly after the flaw was detected, and the team announced it would undergo an audit before being brought back online.
CFTC subpoenas former company of Ben "BitBoy" Armstrong over crypto promotion
Kujira token tanks as team's leveraged bets melt down
The Kujira team apologized for the fiasco, and announced a plan to create a DAO to take over the project treasury.
ConvergenceFi hacked for $210,000
Although ConvergenceFi described itself as audited, they admitted they had made changes to that portion of the code after the audits.
They assured their users that all user funds were safe, but recommended that users remove their staked funds from the platform.
- "Post-mortem | 08/01/2024", ConvergenceFi Medium [archive]
ZKX decentralized exchange shuts down in what some VCs are describing as a rug pull
ZKX had raised $4.5 million in seed funding from investors including the now-bankrupt Alameda Research, Starkware, HTX, Amber Group, ArkStream Capital, and HashKey Capital. The project had announced a second, $7.6 million raise only a few weeks before its shutdown.
People at Amber Group, ArkStream, and HashKey publicly criticized the lack of transparency from ZKX around its financial situation. Ye Su, a founding partner at ArkStream, explained that he felt they had been "rug pulled".
Blockchain sleuth zachxbt joined the VCs in characterizing the project as a rug, and further elaborated that he felt the retail investors who had purchased the project's token only weeks earlier had been tricked into buying a token by the project team, who "misled the community/retail ... by giving the appearance the project was healthy and strong when in reality they were in a bad position and about to shut down."
BitClout founder arrested on wire fraud charges
According to the criminal charges, Al-Naji misled investors, including by taking $3 million from an investor and using it for his own personal expenses and gifts to family. Al-Naji had told investors that the sales of the platform's token would not go to him or to other employees.
The SEC complaint separately alleged that Al-Naji had tried to falsely present the BitClout project as decentralized, including by soliciting a letter of opinion from a law firm that his tokens were not likely to be deemed securities, which was based on mischaracterizations.
BitClout raised money from various prominent firms, including Andreessen Horowitz, Sequoia, Chamath Palihapitiya's Social Capital, Coinbase Ventures and Winklevoss Capital.
- "Founder Of 'BitClout' Digital Asset Charged With Fraud In Connection With Sale Of 'BitClout' Tokens", U.S. Attorney's Office, Southern District of New York [archive]
- "SEC Charges Nader Al-Naji with Fraud and Unregistered Offering of Crypto Asset Securities", U.S. Securities and Exchange Commission [archive]
- "SEC charges BitClout founder Nader Al-Naji with fraud; says proceeds paid for L.A. mansion, gifts", TechCrunch [archive]
DraftKings abruptly shutters its Reignmakers NFT project and marketplace due to "recent legal developments"
In an announcement in the project Discord and on their website, DraftKings wrote that the shutdown was "due to recent developments". They offered holders the ability to cash out their Reignmakers cards "based on factors that include, but are not limited to, the relative size and quality of your digital game piece collection". Holders were also invited to transfer their NFTs to their own cryptocurrency wallets, although the DraftKings-run "contests" in which people used their NFTs to try to earn rewards and win prizes will no longer exist. It's also unclear whether some NFTs, built to not be transferrable off-marketplace, will be able to be retained by their holders.
Members of the DraftKings Discord reacted with chagrin to the news, and doubt that the vague promises of cash payments would amount to much. "What kind of compensation u think we get coming to us? Pennies?" wrote one. "Yeah I'm out like $20k," said another. Some blamed the shutdown on a recent lawsuit from a holder of the Reignmakers NFTs who lost $14,000 — a lawsuit which recently survived the motion to dismiss stage.