What happened to the DeFi protocols that were attacked?

Within 52 hours of the Poly Network attack, security companies, white hat hackers, trading platforms and other parties joined forces to return all the transferred assets.

Around the same time, Neko Network, a product developed by the team Maze Protocol, an on-chain credit lending project, was also hacked. However, perhaps because the amount stolen was small and the community didn't notice much, only $1.1 million was returned.

With the development of the industry, DeFi protocol is attacked more and more frequently, and the amount involved becomes more and more large over time. According to the Cryptocurrency crime report released by blockchain security company CipherTrace in July 2021, DeFi protocol was hacked in 2020 involving approximately $129 million; In the first seven months of 2021, the amount involved in DeFi attacks rose to $361 million.

Under the background of frequent DeFi protocol attacks, BlockBeats collects statistics and combs the status quo of those protocols under attack.

Bondly Finance

On July 14, digital collectibles market platform Bondly Finance was attacked, overminting 373 million Bondly tokens on the Ethereum network. On July 16, Bondly co-founder Brandon Smith said he would voluntarily step down as CEO, and Bondly CEO will be replaced by another co-founder, Harry Liu.

In the latest official announcement, the team is redefining its strategy and negotiating with investors. A partnership has been struck with third-party audit firm Trustlook, who will audit the new deployment contract. The price of the BONDLY token had not recovered from the hack at press time, falling about 89.2% before the attack.

Anyswap

On July 12, Anyswap Multi-link was attacked by the V3 version, losing about 2.4 million USDC and 5.51 million MIM. According to the official analysis after the event, the reason for the attack is that two transactions signed by the same account appeared in the BSC chain. If the transactions signed by the same account have the same RSV signature R value, the hacker can reverse deduce the private key of the account.

After the event, Anyswap provided full compensation and filled the liquidity within 48 hours.

According to Debank data, Anyswap's lock-ups and trading volumes have not been affected by the hack, but have increased. The number of transactions and the number of transactions users showed a slight decline.

ChainSwap, RAI Finance

On July 4, RAI Finance, a cross-chain transaction protocol based on Polkadot blockchain, published an article saying that due to the ChainSwap smart contract vulnerability, the access and payment rights address of RAI connected to it were hacked and stolen, and a total of 2.9 million RAI were stolen from the account. After this happened, on July 11, RAI Finance was stolen again due to Chainswap contract vulnerability, and a total of 700,000 RAI were stolen this time.

After the incident, RAI officials said they would consider replacing the cross-chain bridge partner.

On July 5, the hackers returned 2.25 million of the 2.9 million stolen for the first time, and ChainSwap paid for the remaining 670,000 lost pieces. ChainSwap pays in the form of 50% USDC and 50% platform token ASAP.

In addition to affecting RAI Finance, the theft occurred again on July 11, Also covered are Antimatter, Corra, DAOventure, FM Gallery, Fei Protocol, Fair Game, Rocks, PERI Finance, Strong, WorkQuest, Dora Factory, Unido, Unifarm, Wilder Worlds, Nord Finance, OptionRoom, Umbrella, Razor, Dafi Finance, OroPocket, KwikSwap, Vortex, Blank, Rai Finance, SakeSwap, etc.

ChainSwap subsequently airdrops LP and ASAP tokens using snapshots.

As of press time, RAI and ASAP prices have almost returned to pre-attack levels. ChainSwap has partnered with Anyswap to develop V2 and will reopen the cross-chain bridge service after completing cross-chain integrity testing.

THORChain

THORChain was first attacked on June 29, costing $140,000. After the official team discovered the attack, it fixed the vulnerability within 30 minutes, and THORChain took all the losses.

On July 16, THORChain suffered a second attack that resulted in the loss of about 4,000 ETH. After the attack, the THORChain team shut down BEPSwap and investigated. The team then restarted the network and deposited the funds into the ETH pool to compensate the liquidity provider for the lost funds.

A week later, THORChain suffered a third attack that cost 2,000 ETH. THORChain Vault will compensate for the loss. A number of investors and funds are understood to be interested in financing THORChain's Treasury reserves, with the possibility of further financing through an over-the-counter transaction.

THORChain's price hit its recent low after the third attack, perhaps because of the large number of investors and funds expressing a propensity to raise capital, and has since risen. At press time, it was $7.34, up 105% from July 23.

Value DeFi

On May 5, hackers attacked Value DeFi and profited 205,000 BUSD and 8,790 BNBS.

It is understood that the attacker to initialize the Value DeFi pools, and sets the operator role to its own, and _stakeToken set to HACKEDMONEY, the attacker control of the pool and call governanceRecoverUnsupported (), Ran out of original pledge tokens (vBWAP/BUSD LP). Then, the attacker removes 10839.16 vBWAP/BUSD LP and liquidity, and gets 7342.75 vBSWAP and 205659.22 BUSD, subsequently, The attacker sold all the 7342.75 vBSWAP at 1inch to obtain 8790.77 BNB, and then bought BNB and BUSD to renBTC, and converted the funds into BTC through renBridge.

Value DeFi then uses the reserve fund and deployer to compensate for part of the loss, and the remaining loss will be provided with two options for users to vote on.

Currently, Value DeFi's total lock volume across the chain bridge is $19.01 million, including $17.07 million for the BSC network and $1.94 million for the ETH network. As of press release, Value DeFi token Value has dropped 54.19% before the attack.

Alpha Finance

On Feb. 13, the Alpha Finance vault was attacked, losing about $37.5 million. Because the attack operation is more complex, interested users can readThe Inside Story behind Alpha Finance's Theft.

To compensate users, Alpha Homora V2 deposited 1000 ETH in the contract, Cream V2 deposited 1000 ETH in the contract, Tornado Cash Foundation returned 100 ETH. The remaining losses will be reimbursed by 20% of the reserves in Alpha Homora V1 and V2 on a monthly basis. At the same time, Alpha Finance Lab lock-up 50 million Alpha to ensure the excess mortgage ratio in the Cream V2 pool. After the compensation is completed, this part of the tokens will be returned to Alpha Finance.

As of press time, Alpha Homora V2 has a total lock-in of $1.137 billion, $586 million in collateral, and $393 million in collateral. Today, however, Alpha Finance tokens are down 54.12% from stolen.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia