Crypto exchange BitoPro belatedly discloses $11.5 million hack

The Taiwanese cryptocurrency exchange BitoPro disclosed that they had suffered a theft from one of their hot wallets, which they said occurred during a system upgrade in which they were transferring assets between wallets.

The theft was originally noticed by crypto sleuth zachxbt, who observed a suspicious transfer of around $11.5 million in crypto assets on May 8. The funds sold on decentralized exchanges and then laundered through various cryptocurrency mixing services.

BitoPro originally only told customers that the platform was offline for "maintenance", but disclosed the theft on June 2 after zachxbt published his findings.

Cork Protocol exploited for $12 million

Cork Protocol, a defi project aimed at "tokenizing the risk of depeg events for stablecoins and liquid (re)staking tokens", suffered a $12 million loss after an attacker exploited a bug in how the project's smart contract calculated exchange rates. The attacker stole around 3,762 wrapped staked ETH (wstETH), which they exchanged for ETH. The project announced that they were investigating the theft and had paused markets.

Cork had been audited in whole or in part by four different security firms. The project's funders include Andreessen Horowitz, OrangeDAO, and Steakhouse Financial, and Cork is a part of Andreessen Horowitz's Crypto Startup Accelerator.

Cetus DEX exploited for $223 million; some funds "paused"

An attacker stole $223 million from the Sui-based Cetus Protocol. The project announced shortly after that $163 million of the funds had been frozen, leaving around $60 million unaccounted for.

This led some to question how decentralized the project truly is if the funds can be frozen in such a way.

Sui validators later voted to return the frozen assets to the Cetus project. Cetus also announced that users would be fully compensated, and that they would cover the $60 million gap with project treasury funds and a loan from the Sui Foundation.

Curve Finance website and Twitter account hacked

The website and Twitter accounts belonging to the Curve Finance defi projects were compromised in quick succession. On May 5, an attacker compromised the Twitter account belonging to the project, posting a scam in which they appeared to announce an airdrop.

Then, on May 12, the project posted a warning that the website for the Curve frontend was "hijacked" in an apparent domain takeover.

This is not the first such compromise for Curve, which suffered a frontend compromise in August 2022 that resulted in $620,000 in losses (later recovered with the help of some exchanges).

Founder of Zerebro token fakes his death, promotes new "legacy" coin

Jeffy YuJeffy Yu (attribution)
On May 4, 22-year-old Zerebro founder Jeffy Yu published a blog post introducing "legacoins" — a version of memecoins he said would be used to "define the legacy" of those who had died. Several days later, Yu's Twitter account announced that a "deadman's switch" had triggered the launch of his own "legacoin", $LLJEEFFY. Elsewhere, a video appeared to record Yu's suicide, and an obituary describing him as a "martyr of imagination and creativity" appeared on Legacy.com.

It wasn't long, however, before people began to speculate that Yu had faked his death. Wonderland CEO Daniele Sestagalli published a letter he said he had privately received from Yu, where he confessed to faking his death and described it as his "only viable exit from persistent harassment, blackmail, and threats". Others noted that wallets belonging to Yu had been cashing out $ZEREBRO tokens priced at around $1.3 million.

Reporters from the San Francisco Standard ultimately located Yu at his parents' house, where he was "agitated and shocked that he had been found after some routine internet searches", and "declined to talk about the false report of his death or how he may have benefited financially from it."