
Some initially interpreted the hack as an exploit of the Uniswap V3 protocol, but it was quickly clarified as the result of a phishing campaign.
A sophisticated phishing campaign targeting liquidity providers (LPs) of the Uniswap v3 protocol has seen attackers make off with at least $4.7 million worth of Ethereum (ETH). However, the community is reporting the losses could be even greater.
Metamask security researcher Harry Denley was one of the first to raise the alarm bells of the attack, telling his 13,000 Twitter followers on July 11 that 73,399 addresses had been sent malicious ERC-20 tokens to steal their assets.
⚠️ As of block 151,223,32, there has been 73,399 address that have been sent a malicious token to target their assets, under the false impression of a $UNI airdrop based on their LP's
— harry.eth (whg.eth) (@sniko_) July 11, 2022
Activity started ~2H ago
0xcf39b7793512f03f2893c16459fd72e65d2ed00c
cc: @Uniswap @etherscan pic.twitter.com/5W51AikFuV
At least $4.7 million in ETH has been lost in the attack, according to a Twitter post from Binance CEO Changpeng “CZ” Zhao. However, there are also reports amongst the crypto community that there may be more significant losses from the incursion.
Prominent crypto Twitter user 0xSisyphus noted on July 11 that a “large LP” with around 16,140 ETH, worth $17.5 million, may have also been phished.
did a large LP get phished?https://t.co/3n6oruM8Hj
— Sisyphus (@0xSisyphus) July 11, 2022
the v3 NFTs in 0x09b5 all originated from this wallet which has 16k ETH ($18m) sitting in it
According to Denley, the phishing attack works by sending unsuspecting users a “malicious token” called “UniswapLP” — made to appear as coming from the legitimate "Uniswap V3: Positions NFT" contract by manipulating the “From” field in the blockchain transaction explorer.
Users curious about their new tokens would be directed to a website purporting to allow them to swap their new tokens for Uniswap’s native token UNI, worth $5.34 each at the time of writing.
The website would instead send the users’ address and browser client info to the attackers’ command center, which would also attempt to drain cryptocurrency from their wallets.
A Reddit post also explaining the attack noted that the attackers had stolen native tokens (ETH), ERC20 tokens, and NFTs (namely Uniswap LP positions) from victims.
Please be aware that there is currently a Phishing scam happening that targets Uniswap V3 LP’s.
— Mel (@belikewater893) July 11, 2022
It does not look like a Uniswap protocol hack.
No matter what, if you get tokens airdropped to your wallet of ynknown origin - DON’T Interact with them !!!
Binance’s CEO Zhao created some waves in the crypto markets when he first sounded alarms about the attack, calling it a “potential exploit” of the Uniswap protocol on the ETH blockchain.
Related: Finance Redefined: Uniswap goes against the bearish trends, overtakes Ethereum
Zhao clarified soon after the post with another update, sharing a conversation with the Uniswap team, who noted the attack was part of a phishing attack rather than any issue with the protocol.
Connected with the @uniswap team. The protocol is safe.
— CZ Binance (@cz_binance) July 11, 2022
The attack looks like from a phishing attack. Both teams responded quickly. All good. Sorry for the alarm.
Learn to protect yourself from phishing. Don't click on links. pic.twitter.com/FIXebz3iBC
CZ’s initial alarming comments coincided with a sharp drop in the Uniswap price, which fell to a 24-hour low of $5.34. The price of UNI has since recovered following the clarification to $5.48 at the time of writing but is still down 11% in 24 hours and is 87.8% down from its all-time-high (ATH).
Acala was victorious in Polkadot’s first parachain auction, Iota announced its staking network, and Uniswap liquidity providers lose money — all coming to you in this week’s Finance Redefined.
Welcome to the latest edition of Cointelegraph’s decentralized finance newsletter.
Read on to discover why almost half of the liquidity providers on Uniswap v3 are losing capital due to impermanent loss.
What you’re about to read is the smaller version of this newsletter. For the full breakdown of DeFi’s developments over the last week, subscribe below.
Decentralized finance protocol Acala was announced as the winning project in Polkadot’s inaugural parachain auction this week, beating fellow competitor Moonbeam to the finish line with a seismic total of 32.5 million DOT ($1.28 billion) raised from 24,934 contributors.
Acala is a multi-functional DeFi platform built on Polkadot that enables developers to build smart contracts applications with cross-chain capabilities, as well as being compatible with Ethereum. Its top investors include Digital Currency Group, Polychain Capital and Alameda Research, among others.
In the case of Acala, all of the proceeds from the crowdloan initial coin offering are classified as “crypto debt” and, therefore, must be paid back by the project following the conclusion of the rental agreement.
With over 32M DOT contributed by over 81,000 community members, Acala has won the first parachain auction on @Polkadot!
— Acala - DeFi Hub of Polkadot (@AcalaNetwork) November 18, 2021
Thank you to everyone who took part in this historic event. (1/3) pic.twitter.com/CL2jCwA9Re
Related: DFG piles $12.6M into Astar Network’s Polkadot parachain bid
The Iota Foundation, an open-source, nonprofit entity endeavoring to support the Iota ecosystem, announced the upcoming launch of a staging network, Shimmer, this week alongside an accompanying token asset, SMR.
Shimmer is a layer-one sandbox platform that will enable builders and developers to test the efficiency and compatibility of their decentralized applications within the DeFi and NFT space, prior to deployment on the Iota mainnet.
Expected to launch in early-2022, the network will also facilitate community governance confirmations for Iota’s large-scale network upgrades, including the upcoming programmable multi-asset ledger, smart contracts, full decentralization and sharding.
Related: Iota launches beta smart contracts to foster interoperability
A research report published this week by Topaz Blue and the Bancor Protocol revealed that almost half, 49.5%, of liquidity providers on Uniswap v3 have experienced financial losses due to impermanent loss, a common occurrence on automated market makers when supplying two-sided, volatile liquidity pairs.
An instance of this would arise if, for example, a user has supplied equal values of Tether (USDT) and Ether (ETH) in United States dollars to a liquidity pool and the price of ETH goes up.
This would mean that arbitrageurs — investors who often work in accordance with financial institutions to benefit from price discrepancies in the market — will remove ETH from the pool to sell at a higher price. This leads to a decrease in the U.S.-dollar value of the user’s position and, consequently, an impermanent loss.
The report suggested that, based upon current statistics, it may well be more profitable to simply hodl the market, as opposed to actively participating in liquidity services, stating:
“The user who decides to not provide liquidity can expect to grow the value of their portfolio at a faster rate than one who is actively managing a liquidity position on Uniswap v3.”
Related: Bancor releases no-liquidation lending with Vortex as AMMs continue diversification
Analytical data reveals that DeFi’s total value locked has decreased 7.89% across the week to a figure of $160.47 billion.
Data from Cointelegraph Markets Pro and TradingView reveals DeFi’s top 100 tokens by market capitalization performed indifferently across the last seven days.
Avalanche (AVAX) secured the podium’s top spot with 30.11%. Curve DAO Token (CRV) came in second with 0.67%, while Maker (MKR) came third with 0.34%.
Analysis and hot topics from the last week:
Thanks for reading our summary of this week’s most impactful DeFi developments. Join us again next Friday for more stories, insights and education in this dynamically advancing space.