Stolen Poloniex Ether worth $53M never made it back to the exchange

May 14, 2024 Coin Telegraph

Binance to Withdraw From Canadian Market Due to Regulatory Climate

May 13, 2023 Bitcoin.com

Blockchain security firm freezes $160K stolen in Merlin DEX ‘rugpull’

May 5, 2023 Coin Telegraph

<div>Blockchain security firm freezes 0K stolen in Merlin DEX 'rugpull'</div>

Audit Summaries

CertiK has contacted law enforcement in the U.S. and U.K. to find the pseudonymous operators.

Smart contract auditor CertiK claims to have blocked $160,000 from Merlin, a zk-Sync-based decentralized exchange (DEX) which has been the center of a rogue insider "rugpull" that lost users $1.8 million last week.

CertiK shared the news of its successful $160,000 freeze of the stolen funds in an update to its 257,700 Twitter followers on May 5.

“We have successfully frozen $160K of the stolen funds with the help of partners,” CertiK said, adding that they’re continuing to monitor the movement of the stolen funds:

We have successfully frozen $160K of the stolen funds with the help of partners. We will continue to monitor the movement of all stolen funds in an attempt to freeze and recover the remaining amount.
— CertiK (@CertiK) May 4, 2023

The firm explained that they tried to “collaborate” with Merlin to recover the funds stolen from the April 25 "rugpull" but the effort was to no avail.

It led the firm to reach out to law enforcement in the United States and the United Kingdom in an attempt to uncover the identities of the pseudonymous operators:

“This lack of cooperation has complicated our efforts to validate and aid victims. We are focusing on working with law enforcement and have submitted information to relevant US & UK agencies.”

“We are exploring all possibilities to fight exit scams with the $2M we’ve committed,” CertiK added.

The security firm believes the “rogue developers” are based in Europe, according to an earlier post.

As for the exit scam, CertiK said “Merlin insiders abused the owner's wallet privileges,” which is consistent with its initial finding that it came from a private key issue as opposed to an exploit.

Merlin claims the rug pull was carried out by its back-end team, which they claim to have put a “high degree of trust in.”

We are deeply saddened by the actions of the technical team, whom we put a high degree of trust in. Merlin will continue to support our community and resolve the issue.
— Merlin (@TheMerlinDEX) April 26, 2023

CertiK, on the other hand, attributed part of the blame to themselves for failing to properly inform users of the centralization risks.

In a note to Cointelegraph, the firm said they would place more emphasis on this in future audit summaries.

“We are working to improve the clarity of our audit summaries in our reports - especially around centralization risks — and to better communicate with the community about the purpose of an audit.”

Going forward, CertiK will prioritize centralization risks in audit summaries to ensure users have a complete picture of potential risks.

We recognize that audit reports can be highly technical documents, and it’s our job to communicate the risks clearly and transparently.
— CertiK (@CertiK) May 4, 2023

CertiK however stressed that smart contract auditors shouldn’t be held fully responsible for failing to identify rug pulls:

“Code Audits serve the purpose of uncovering vulnerabilities, not to detect a potential rugpull. Its important to recognize that many projects both large and small have centralization issues flagged, and the vast majority do not result in a rugpull,” the firm said.

The firm launched a $2 million compensation plan to cover the funds lost as a result of the “exit scam” on April 27.

The firm added that the funds pledged will be used to prevent exit scams and assist victims where possible.

Magazine: Crypto audits and bug bounties are broken: Here’s how to fix them

Tornado Cash dev says ‘sequel’ to crypto mixer aims to be regulator-friendly

March 7, 2023 Coin Telegraph

Alexey Pertsev

Soleimani explained that the “critical flaw” with Tornado Cash is that users cannot prove that they’re not associated with a criminal enterprise stealing or laundering crypto funds.

A former Tornado Cash developer claims to be building a new crypto mixing service that aims to solve a “critical flaw” of the sanctioned crypto mixer — which he hopes will convince U.S. regulators to reconsider its position on privacy mixers.

The code of a new Ethereum-based mixer, “Privacy Pools,” was launched on GitHub on Mar. 5 by its creator, Ameen Soleimani.

In a 22-part Twitter thread, Soleimani explained that the “critical flaw” with Tornado Cash is that users cannot prove that they’re not associated with North Korea’s Lazarus Group or any criminal enterprise for that matter.

1/ We fixed @tornadocash

v0 of https://t.co/Nt4b2Tgx1D is live on @optimismFND

test out the demo, but please note:
- this is experimental code
- it has not been audited
- the trusted setup is untrusted

read the full story anon https://t.co/9nAU3RrgpN
— ameen.eth (@ameensol) March 4, 2023

With Privacy Pools, however, Soleimani explained that depositors and withdrawers could opt out of an anonymity set that contains an address associated with stolen or laundered funds.

This feature of Privacy Pools is executed with zero-knowledge (ZK) proofs, meaning that the privacy of the user is preserved:

“Now, users have the option to help regulators isolate illicit funds, without revealing their entire transaction history [...] With privacy pools, just because someone deposits into the same smart contract as you, it doesn't mean they can also force you into sharing an anonymity set with them. It's your choice.”

Soleimani provided a demonstration of how Privacy Pools is used:

13/ Our demo is live - https://t.co/Nt4b2Tgx1D

Now, users have the option to help regulators isolate illicit funds, without revealing their entire transaction history.

Let's watch a brief video of it in action: pic.twitter.com/An9lWx6jfr
— ameen.eth (@ameensol) March 4, 2023

The developer hopes the solution will empower “the community to defend against hackers abusing the anonymity sets of honest users without requiring blanket regulation or sacrificing on crypto ideals.”

While Privacy Pools is already live on Optimism, Soleimani noted that the first version of the privacy protocol is still in its “experimental” stage because the code isn’t complete and has not been audited, but he is “pretty close to having this ready.”

To see the protocol progress further, Soleimani wants on-chain forensics platforms like Chainlaysis and TRM Labs to conduct tracebacks on deposits so that users of the privacy tool don’t have to manually create their own subset exclusion lists.

In making the case for on-chain privacy protocols, Soleimani cited what he described as an “excellent” report by the Federal Reserve Bank of St. Louis in Missouri which examined the trade-offs between on-chain privacy and regulation:

“Their report proposes to achieve effective regulation by having Tornado Cash users provide receipts to an intermediary, thus revealing their entire transaction history to the intermediary, but still being able to have privacy with respect to other public blockchain users.”

The developer hopes this can help “start a conversation” with U.S. regulators on how on-chain privacy can be preserved whilst restricting criminal activity through the use of ZK proofs.

Soleimani’s attempt to create a crypto-friendly on-chain privacy solution comes after the U.S. Office of Foreign Asset Control (OFAC) sanctioned ETH and USDC addresses linked to Tornado Cash on Aug. 8 in response to several alleged thefts by North Korea’s Lazarus Group, who were claimed to have routinely used the privacy mixer to preserve its anonymity.

*Photograph of a #FreeAlex protest. Source: Ameen.eth Twitter*

Shortly after the sanction on Aug. 10, Alexey Pertsev, the creator of Tornado Cash was arrested by authorities in the Netherlands and is currently facing a series of money laundering charges. He remains behind bars and his next hearing will take place in late April.

Former FTX CEO Sam Bankman-Fried Faces New Charges in Multi-Billion Dollar Fraud Case

February 23, 2023 Bitcoin.com

$333 Million in Bitcoin Vanished from FTX Days Before the Company Filed for Bankruptcy Protection

November 20, 2022 Bitcoin.com

‘Smear campaign’: Nexo responds to accusations of stealing donations, siphoning funds from charity

June 27, 2022 Coin Telegraph

Cease and Desist

A pseudonymous Twitter account making a series of accusations against Nexo has caused the crypto lender to issue a cease and desist notice.

Cryptocurrency lending platform Nexo has hit back at what it called “fake news” and rumors that its founders were part of a charity embezzlement scandal, saying the claims are untrue and defamatory. It has issued a public cease and desist notice to the originator of the allegations.

In a blog post about the claims, Nexo stated:

“Several anonymous Twitter accounts are using lies and distortion in yet another smear campaign against Nexo and profiting from short positions in a distressed market.”

The pseudonymous Twitter account otteroooo, who calls themselves “Otter,” posted a series of tweets on June 25, claiming that Nexo’s co-founders stole funds from the Bulgarian charity HelpKarma to buy real estate and fund “lavish personal travel”.

NEXO FOUNDER & FAMILY SIPHONED FUNDS FROM CHARITY FOR SICK KIDS, USED DONATIONS AS PERSONAL SLUSH FUND, EVEN BUILT A PALACE FOR THEMSELVES

Evidences presented in full by otter below

no bueno!

— otteroooo (@otteroooo) June 26, 2022

The thread garnered a large audience on Twitter, with Otter sharing a screenshot that it had received over 9 million impressions, prompting Nexo to respond to what they say are “ludicrous allegations” and issue the cease and desist notice.

The central allegation Otter makes is that the founder of HelpKarma and co-founder of Nexo "Konsta Kanchev" used funds from donations to help build a palace instead of using the money for children's medical treatments.

Konsta Kanchev (Bulgarian Boy 1) embezzled the funds and went on to build a muthaf*ckin PALACE, "the size of a high school"

The money came from the donations of more than 130,000 Bulgarians who readily donated into what they thought was meant for medical treatment for children pic.twitter.com/NCd7TLbF4A
— otteroooo (@otteroooo) June 26, 2022

In a response by Nexo it points out that a “Konsta Kanchev” doesn’t exist and Otter deliberately made the name “to mimic a typo as an excuse to fact-checkers” by confusing two separate people, HelpKarma founder Constantine Krastev and Nexo co-founder Kosta Kantchev, as the same person.

Speaking to Cointelegraph regarding conflating the two, Otter shared a delisted article from the Bulgarian outlet Fakti saying the two are cousins and that Constantine in Bulgarian is spelled “Konstantin” but has since not provided further commentary.

Another major allegation Otter makes is that as HelpKarma's donations increased, the payday loans company Credissimo started to report considerable increases in its capital, citing a November 2020 report by Fakti, implying that the donations were used to fund Credissimo.

On how this scandal links to Nexo, Otter points out that Nexo's white paper says it's "powered by Credissimo." Credissimo was founded by Kantchev, and Nexo co-founders Georgi Shulev and Antoni Trenchev were the companies' business development and innovation officers, respectively.

In response to the claims, Nexo said that it and HelpKarma “have not and never had any common operations, common beneficial owners or common management,” adding:

“‘Why would a company with hundreds of millions in revenues and billions of assets under management, vetted by Fidelity, Mastercard and dozens of regulators ever have to resort to petty theft, let alone from children with medical needs?’ is the logical yet neglected question.”

Cointelegraph contacted Nexo for comment on the allegations and is yet to receive a response.

The main motive Nexo states as for why Otter posted the allegations is so that Otter can gain a large following and sell the account.

Nexo shared images of an individual who attempted to purchase Otter's account, to which Otter responds they want a minimum of $50,000 USD Coin (USDC) for it.

But in a Twitter thread posted by Otter on June 26, they claim they suspected the messages to be a “set up” to buy the account so that Nexo could silence them. They instead “hatched a troll plan” to sell the Otter account to collect Nexo’s “silence money” and make another account to “continue exposing them.”

Nexo says this isn’t the first time they’ve been part of what they call a “coordinated attack,” citing the 2020 accusations that it was behind Zeus Capital, an asset management firm that wanted to short Chainlink (LINK).

Stolen funds