Altcoin project hacked: 136,000 tokens withdrawn in seconds ⚠️

QuillAudits - Web3 Security 🛡️
QuillHash
Published in
4 min readJan 15, 2022

Events Under the Spotlight

IDO projects Rug Pulled on BSC, estimated loss — $2.6M

  • IDO projects, namely “HarmonyPAD, HbarPad, MetaPlay, Electrinity, MicroPee and QuizDrop” were rugged on BSC.
  • Total loss — $2.6 Million in 5,744 WBNB.
  • Scammers used infamous Tornado Cash to perform the scam.

Project listed on Solanart rug pulled community

  • Solanart is the largest Solana-based NFT marketplace.
  • It listed Big Daddy Ape Club (BDAC), and the project shortly rug pulled the community by ‘secretly’ stealing SOL in the background.
  • BDAC project deleted their social channels but the website is live at the time of writing.
  • According to the intelligence, approximately 9,000 SOL were stolen amounting to $1.2 Million.
  • The scammer wallet was funded using Binance exchange.

NFT marketplace ‘LooksRare’ suffered DDoS attack

LooksRare, a new NFT marketplace, suffered a DDoS attack and went offline.

A Hot Wallet Security Breach that led to a loss of — $18M

  • Lympo NFT platform is a sports NFT minting platform by Animoca Brands.
  • The platform suffered a hot wallet security breach with several tokens.
  • The platform lost $18 Million in the native LNT token.
  • According to the official statement, ten hackers managed to gain access to Lympo’s operational hot wallet.
  • After which, they “stole a total of approximately 165.2 million LMT from it.”
  • At the time of writing, ten projects have been compromised.
  • Project’s cold wallets, where the majority of the tokens are stored, remain secured.
  • Subsequently, $LMK token price dropped to 92%.

LCX’s Hot Wallets compromised, loss — $6.5M

  • LCX is a centralised cryptocurrency exchange.
  • Recently, it reported that their hot wallets were hacked.
  • The stolen assets include ETH, USDC, LCX, etc.
  • Total loss is $6.5 Million.

Altcoin project hacked: 136,000 tokens withdrawn in seconds

  • Due to a vulnerability in the Roco Stake and Farm contracts, the attacker instantly changed the value of the “RocoPerSecond” variable.
  • It was done in the Stake and Farm contract with the bot he created.
  • Hacker obtained tokens by changing and calculating the reward value.
  • He simply transferred the “Total Rewards” balances in the contract.
  • It was stated that the tokens of all ROCO investors and stakers are safe.

Potential exploit discovered in DeFi Dollar’s contracts

DeFi Dollar Finance, a multi-chain DeFi protocol, discovered a potential exploit in the $DUSD smart contract and immediately paused the contracts.

Polygon’s Discord bot impersonated

  • Polygon (Previously Matic) Discord server bot was hacked to impersonate the official Matic team.
  • It was done to make a scam announcement to receive a special giveaway from the Matic team.
  • The bot was later fixed.

To the Numerophiles out there 🔢

  • Crypto Security is the Biggest Concern for Institutional Investors.

Source

More From the Editor’s Desk

According to reports, on January 1, 2022, unauthorized users attacked Tinyman, a decentralized financial platform built on Algorand.

The event was done in four separate attacks, allowing the hackers to steal about $3 million from pools within the protocol.

Checkout the various factors that were responsible for the attack, and lessons that we can derive from it!

Read More

Word on the Block

Versus Series

Proof-of-Work 🆚 Proof-of-Stake..!

Catch out the Key differences between various significant terminologies in the Blockchain.

--

--

QuillAudits - Web3 Security 🛡️
QuillHash

Building the QuillAI Network: AI Agents Safeguarding Web3. Leading Smart Contract Audit Firm with $30B+ secured. Join our security squad builders 🛡️