KyberSwap DEX hacker sends an on-chain message: Be nice, or else

November 29, 2023 Coin Telegraph

Bounty Deal

The exploiter behind the $46 million KyberSwap hack says they plan to outline a treaty for the potential return of funds on Nov. 30, but not if threats and hostilities from execs keep up.

The exploiter behind the $46 million crypto theft against KyberSwap has demanded its execs and tokenholders ease up on the hostilities, threatening to push out negotiations until everyone is “more civil.”

In an on-chain message addressed to KyberSwap executives, tokenholders and liquidity providers on Nov. 28, the exploiter said they plan to release a statement around a potential treaty with KyberSwap on Nov. 30 — but won’t do it if hostilities continue.

“I said I was willing to negotiate. In return, I have received (mostly) threats, deadlines, and general unfriendliness from the executive team,” they said.

“Under the assumption that I am treated with further hostility, we can reschedule for a later date, when we all feel more civil,” they warned.

The @KyberNetwork exploiter sent the team another message! pic.twitter.com/DnuKUWjFMn
— Officer's Notes (@officer_cia) November 28, 2023

The team behind KyberSwap — a cross-chain decentralized exchange — initially suggested a bounty deal where the hacker returns 90% of the funds across all exploits, allowing the hacker to keep the remaining 10%.

But they followed up with a threat to pursue legal action after the hacker didn’t comply straight away.

“We have reached out to law enforcement and cybersecurity on this case. We have your footprints to track you,” the KyberSwap team said in a Nov. 25 on-chain message, adding:

“So it's better for you if you take the first offer from our previous message before law enforcement and cybersecurity track you down.”

KyberSwap also told the hacker they would initiate a public bounty program to incentivize anyone providing information to support law enforcement that may lead to their arrest and the recovery of user funds.

The team behind KyberSwap has already managed to recover $4.67 million from the $46 million exploit on Nov. 26 from operators of front-running bots, which managed to extract around $5.7 million in crypto from KyberSwap pools on the Polygon and Avalanche networks.

The team hasn’t yet responded to the exploiter’s latest message on X (formerly Twitter) and is presumably waiting to see the new treaty proposed by the hacker.

A day after the Nov. 22 hack, decentralized finance pundit Doug Colkitt said the attacker used an “infinite money glitch” to carry out a “complex and carefully engineered smart contract exploit” across several networks implementing KyberSwap pools.

Funds were exploited from Avalanche, Polygon and Ethereum and layer-2 networks Arbitrum, Optimism and Base.

KyberSwap runs on Kyber Network, a blockchain-based liquidity hub that aggregates liquidity across different blockchains and enables the exchange of tokens without an intermediary.

Magazine: This is your brain on crypto: Substance abuse grows among crypto traders

Ethereum-Based Decentralized Finance Protocol Loses $3,260,000 in ETH to Hackers

July 22, 2023 The Daily Hodl

New ‘Pepe the Frog’ Crypto Token Becomes Sixth Largest Meme Coin by Market Cap

April 20, 2023 Bitcoin.com

‘Everything is fine’ — Gala Games calls for calm after fears of multi-billion dollar hack

November 4, 2022 Coin Telegraph

Coin Telegraph

Gala Games said the unusual activity of its pGALA token was actually part of efforts to safeguard it from potential attack.

Blockchain gaming company Gala Games urged its community for calm after misplaced fears of a multi-billion dollar rug pull or hack caused the GALA token to temporarily crash 25.6%.

The initial panic, which Gala Games later implied was unfounded, came after a single wallet address appeared to mint over $2 billion GALA tokens out of thin air — which was flagged by blockchain security firm PeckShield on Nov. 3.

Fears that the unusual activity was a sign of an exploit or rug pull caused the GALA token price to drop a dramatic 25.6% from $0.0394 to $0.0293 over a 130-minute stretch late on Nov. 3, according to data from CoinGecko.

However, Gala Games took to Twitter on Nov. 4 to dispel the “FUD” surrounding its native token, explaining that “lots of people are tossing around words like ‘hack’ and ‘rug’. Neither of these is the case.”

Update for everyone - there is a LOT of FUD out there surrounding $GALA...lots of people tossing around words like "hack" and "rug". Neither of these is the case.

Here is the real story - read this update from @BitBenderBrink and @pNetworkDeFi. https://t.co/ruI16v2Lkv
— Gala Games - Spider Tanks is LIVE! (@GoGalaGames) November 4, 2022

Gala Games president for blockchain Jason Brink explained that the unusual activity detected on decentralized exchange (DEX) PancakeSwap was performed by pNetwork, who was working to drain the liquidity pool as a means to safeguard it from a potential vulnerability.

Before you panic about $GALA, please read this thread from @pNetworkDeFi.

TLDR: Everything is fine. The activity you have been seeing on @PancakeSwap is pNetwork working to drain the liquidity pool. GALA on ETH is completely unaffected.

Do not buy $pGALA on PancakeSwap for now https://t.co/bAnHxlVcp1
— Jason Brink aka BitBender (@BitBenderBrink) November 3, 2022

In a separate tweet, pNetwork, the cross-chain interoperability bridge used by Gala Games on the Binance Smart Chain, confirmed that a “misconfiguration” event took place. It also responded to a tweet from Peckshield to note that it “coordinated the white hat attack” to prevent pGALA from being exploited:

Yes, we noticed pGALA wasn’t to be considered safe anymore and coordinated the white hat attack to prevent pGALA from being maliciously exploited. Funds are safe but users should NOT transfer or buy/sell pGALA on pancakeswap
— pNetwork (@pNetworkDeFi) November 3, 2022

The explanations appear to have quelled some panic, with the GALA token price since partially recovered from its 24-hour low of $0.0293 to now sit at $0.352.

Gala Games confirmed that all GALA tokens on Ethereum and GALA-related assets on the GALA bridge were safe, the team, along with pNetwork informed the community of its decision to “temporarily suspend” transaction activity on the bridge.

Brink also advised not to buy pGALA on PancakeSwap “for now.”

"A new pGALA token will be created to replace the old compromised one” which will be sent to those who owned pGALA before the pool was drained, pNetwork said.

ETH price hits $3K as major crypto fund adds over $110M Ethereum to Lido’s staking pool

March 22, 2022 Coin Telegraph

<div>ETH price hits K as major crypto fund adds over 0M Ethereum to Lido's staking pool</div>

Coin Telegraph

Later, the hedge fund manager reportedly purchased more than $22.50 million worth of ETH tokens from FTX and Deribit.

Ethereum's native token Ether (ETH) rose above $3,000 on March 22 as fresh data suggests Three Arrows Capital staked at least $110 million worth of ETH into Lido's liquidity pools.

The Singapore-based hedge fund manager provided liquidity worth 36,401 ETH to Lido's "Curve stETH pool" using a third-party Ether wallet, data from Etherscan shows. As a result, it became eligible to receive at least 36,401 stacked Ether (stETH) tokens from Lido: to ensure low slippage when un-staking those tokens for real ETH plus staking reward.

*Third-party Ethereum wallet that received ETH from Three Arrow Capital. Source: Etherscan.io*

Almost an hour later, another Ether address, marked with the word "fund," sent 6,993 ETH (worth $21.12 million) to the Curve stETH pool, hinting that Three Arrows Capital was adding more liquidity to the Lido's coffers. If correct, the fund may have already staked more than $130 million worth of Ether on March 22.

Participating in ETH 2.0?

The Three Arrows Capital's massive Ether inflow into Lido staking pools came ahead of the launch of Ethereum's new validation system in summer 2022.

Ethereum will switch its network protocol from energy-intensive proof-of-work to proof-of-stake, which lets users validate transactions and add blocks to the Ethereum blockchain by staking 32 ETH or its multiples for at least one year to earn annual yields.

*Ethereum total number of validators as of March 21, 2022. Source: Glassnode*

But only 8% of the current ETH supply has been staked into ETH 2.0 contracts since its introduction in December 2020, underscoring that average Ether users are reluctant to lock 32 ETH — about $100,000 at March 22's price — for a year. That has created opportunities for liquidity mining providers like Lido.

Notably, Lido allows users to lock any amount of Ether to participate in running the ETH 2.0 chain without lock-ups. As a result, it now represents more than 80% of the Ethereum liquid mining space, holding nearly $8.25 billion worth of ETH in its pools at March 22's prices.

*Lido versus other Ethereum liquidity mining pools. Source: Defi Llama*

Hence, Three Arrows Capital's looks intent to become a validator on the Ethereum network via a less risky alternative like a liquidity staking pool. Meanwhile, the fund appears to have also been accumulating more Ether.

Accumulation after staking

Three Arrows Capital's address received about $22.50 million worth of Ethereum tokens from wallets associated with crypto exchanges FTX and Deribit on March 22, less than an hour after it staked 36,401 ETH into the Lido's pool.

The Three Arrows Capital address (0x4862733B5FdDFd35f35ea8CCf08F5045e57388B3) has inflowed 7,500 ETH in the past seven hours, with a total value of about $22.43m; of which 5,500 ETH was withdrawn from FTX and 2,000 ETH was withdrawn from Deribit. https://t.co/27A1u6o4su
— Wu Blockchain (@WuBlockchain) March 22, 2022

It wasn't clear whether Three Arrows purchased the coins anew or merely withdrew them for holding or further staking. But in either case, the firm contributed to what appears like a constant depletion of Ether reserves across the crypto exchanges, considered by many ETH traders a bullish signal.

Nonetheless, PostyXBT, an independent market analyst, highlighted $3,000 as a key inflection zone for ETH price, noting that only flipping above it decisively could have Ether eye a move toward $3,500.

*ETH/USD 12-hour price chart. Source: PostXBT, TradingView*

"I think we see a further +10% move towards key resistance," he wrote.

The views and opinions expressed here are solely those of the author and do not necessarily reflect the views of Cointelegraph.com. Every investment and trading move involves risk, you should conduct your own research when making a decision.