Crypto Project Built on Kusama (KSM) Skyrockets 188% This Week Amid Wider Polkadot (DOT) Ecosystem Momentum

December 30, 2023 The Daily Hodl

Multichain MPC bridge sees $100M+ outflows, sparking fears of exploit

July 6, 2023 Coin Telegraph

Bridge

Some Multichain contracts on Ethereum suffered withdrawals of more than half of their deposits, causing on-chain sleuths to fear an exploit is underway.

Abnormally large outflows from the Multichain MPC bridge platform on July 6 have sparked fears that an exploit could be underway. Over $102 million worth of crypto has been withdrawn from Multichain’s Fantom bridge on the Ethereum side, as well as $666,000 from Dogechain and $5 million from Moonriver.

Multichain likely hacked. Exit all multichain assets. Good idea to revoke approvals to multichain bridge if you had any
— Curve Finance (@CurveFinance) July 6, 2023

On July 6, 7,214 Wrapped Ether (WETH) tokens (worth $13.6 million), 1,024 Wrapped Bitcoin (WBTC) (worth $31 million) and $58 million worth of US Dollar Coin (USDC) were withdrawn from the Fantom bridge’s Ethereum smart contract, with a total of approximately $102 million in cryptocurrency withdrawn.

*July 6 withdrawals from the Multichain Fantom Bridge contract on Ethereum. Source: Blockchain data*

In addition, the Dogechain bridge’s Ethereum contract saw a withdrawal of $666,000, which represented more than 86% of its total deposits, leaving only around $100,000 worth of assets remaining in the bridge. $5,872,661 worth of USDC and Tether (USDT) were withdrawn from the Multichain Moonriver bridge contracts on Ethereum, leaving only around $700,000 remaining on it.

Several on-chain sleuths took to Twitter to label the event as a possible exploit. Blockchain security firm Peckshield tagged the Multichain team in a post showing the Fantom bridge transactions, saying “You may want to take a look.”

Hi @MultichainOrg you may want to take a look: https://t.co/D4GKGpuBtw pic.twitter.com/3qURqGmes8
— PeckShield Inc. (@peckshield) July 6, 2023

This led one commenter to remark that it looks like “another massive hack.” On-chain investigator Spreek posted the Dogechain transactions with the comment “dogechain multichain drained.”

Cointelegraph could not confirm by the time of publication whether the contracts were “drained” or whether a large amount of funds were simply withdrawn by users.

Cointelegraph reached out to the Multichain team on their Discord channel, but did not get a response by the time of publication. Multichain's last post on Twitter was June 29.

Multichain is a multi-party computation (MPC) bridging network. When a user wants to bridge assets from one chain to another, the Multichain network first confirms that the assets have been locked on the first chain and then mints derivative assets on the second chain.

When a withdrawal is made, the network goes through this process in reverse: it first confirms that the derivative coins have been destroyed on the second chain, then releases the assets backing them on the first chain.

The Multichain team claims that the cryptographic keys controlling this process are split into multiple shards and distributed throughout the network. This should theoretically prevent any single person or group from being able to make unauthorized withdrawals.

Multichain has been suffering from unspecified technical problems over the past few weeks. On May 31, the team announced that their CEO had gone missing and they were experiencing “multiple issues due to unforeseeable circumstances,” leading to delayed transactions. On July 5, Binance halted withdrawals of some Multichain derivative tokens due to the network failing to process transactions in a timely manner.

Asia Express: HK crypto ETFs on fire, Binance warns on Maverick FOMO, Poly hack

Four Altcoins Built on Polkadot (DOT) Explode Amid Rapid Ecosystem Developments

April 4, 2022 The Daily Hodl

Latest DeFi bridge exploit results in $4.4M losses for Meter

February 8, 2022 Coin Telegraph

Latest DeFi bridge exploit results in .4M losses for Meter

Coin Telegraph

Another token bridge suffered a malicious attack where tokens were minted by a hacker through a smart contract exploit, eventually leading to a cascade effect across other DeFi networks.

The Meter Passport token bridge platform has incurred $4.4 million in losses due to a smart contract hack which also caused Hundred Finance to lose $3.3 million through under-collateralized loans.

Meter.io’s Meter Passport (MTRG) is a token bridge that is compatible with Ethereum and its sidechains. This attack affected the Moonriver side of the bridge.

Moonriver is a smart contract platform based on Polkadot’s Kusama network. Hundred Finance is a crypto lending platform based on the code for Compound Finance.

Starting at 2pm UTC on Feb. 5 and over the course of several transactions, about $4.4 million in Binance Coin (BNB) and wETH were minted through a “wrong trust assumption” in the code, according to a Feb. 6 statement from the Meter team. In this case, an arbitrary amount of ETH was deposited to Meter which the hacker used to mint tokens using the vulnerability.

1. Around 6am Pacific time we identified someone was able to leverage a vulnerability of the bridge to mint a large amount of BNB and WETH tokens and depleted the bridge reserve for BNB on WETH.
— ⚡️Meter.io⚡️ (@Meter_IO) February 5, 2022

The attack caused a cascade effect across the Kusama-based Moonriver ecosystem. After draining Meter of its BNB and wETH reserves, the attacker sold the BNB on SushiSwap, a popular decentralized exchange. This led to a 77% crash in the price of BNB on Moonriver at the time.

A number of opportunists then took advantage of the price dip by buying cheap BNB. They used the tokens as collateral on Hundred Finance in order to take out FRAX and MIM stablecoin loans. Due to the discrepancy in BNB price, however, their loans were worth more than the collateral they had provided, causing a supply crisis.

2/4. Accounts were able to purchase BNB.bsc at a reduced price and use these tokens as collateral at the global Chainlink price to borrow uncompromised assets on our platform. Of these, MIM and FRAX are currently impacted.
— Hundred Finance (@HundredFinance) February 6, 2022

Amazingly, two of the loans were repaid, leaving an outstanding $3.3 million in losses to the Hundred protocol. The Hundred team has attempted to reach out to the parties involved to ask that they return the BNB tokens used as collateral to Meter.

The Meter team has committed to reimbursing its community and Hundred Finance for losses incurred due to the hack. The team stated on Feb. 6 that it had set aside $4.4 million in MTRG tokens to cover initial losses.

“Vfat”, the pseudonymous founder of Hundred Finance, said in a statement to Rekt News on Feb. 6 that:

“Meter have of course accepted responsibility for this hack and are intending to use their native token for reimbursement to the extent that they can, currently we are in the gathering addresses and amounts stage.”

The blockchain security firm PeckShield estimated that in total, 1,391 ETH and 2.74 wBTC were taken by the attacker and have since been sent to Ethereum where the tokens have gone through Tornado Cash, an ETH transactions privacy tool.

The Hundred Finance team has not yet responded to a request for comment.

The initial details of the exploit of Meter’s code resemble the Wormhole hack on Feb. 3 in which 120,000 wETH ($321 million) were maliciously minted and extracted from Wormhole’s platform. In that incident, the hacker exploited a smart contract bug to mint wETH at will and sent the tokens to Ethereum, where they were washed via Tornado Cash.