Monthly DeFi Blood Bath Report #4
Welcome to another instance of the Blood Bath report. This month was the craziest one in the whole DeFi history due to two events: the Poly Network hack and Samczun’s Whitehack of Sushiswap.
This month we saw some big hacks, even excluding PolyNetwork. But what is also important, we saw some major white hacks that saved a lot of funds from well-known protocols 💪
Last month we witnessed hacks directed at the bridges. It’s no longer a case this month as a new contender entered the Blood Bath report. NFT.
Enough of the talk. Let’s dive into the topic. Below you will find a summary of all hacks that had happened. All info was compiled from openblocksec , ~rekt.news~, Peckshield, and Blocksecteam
Popsicle Finance
When? Aug-03-2021
How much? $20.7M
Where? ETH
Why? Reward calculation error
Link: https://blocksecteam.medium.com/the-analysis-of-the-popsicle-finance-security-incident-9d9d5a3045c1
Wault Finance
When? Aug-04-2021
How much? $816K
Where? BSC
Why? Issue with $WUSD pegging mechanism
Link: https://waultfinance.medium.com/wusd-incident-recap-and-solution-1751a042e170
Casper DeFi
When? Aug-04-2021
How much? $172K
Where? BSC
Why? Malicious insider addded a backdoor to mint tokens
Link: https://casperdefi.medium.com/casper-defi-post-mortem-after-casper-token-hack-fe668f6722b9
Zerogoki
When? Aug-08-2021
How much? $670K
Where? ETH
Why? Price Oracle manipulation
Link: https://blocksecteam.medium.com/the-analysis-of-the-zerogoki-attack-da4e0807b1840
Poly Network
When? Aug-10-2021
How much? $611M * (most of that was returned)
Where? ETH, BSC, Polygon, Ontology
Why? Cross-chain message validation erro
Link: https://mudit.blog/poly-network-largest-crypto-hack/, https://www.rekt.news/polynetwork-rekt/, https://peckshield.medium.com/polynetwork-bug-review-and-patch-analysis-88bde8441297
Punk Protocol
When? Aug-10-2021
How much? $8.95M
Where? ETH
Why? Reinitialized contract
Link: https://www.rekt.news/punkprotocol-rekt/
Neko Network
When? Aug-11-2021
How much? $4M
Where? ETH
Why? Logic error in a lending protocol
Link: https://blog.mazeprotocol.com/neko-hacking-incident-report-e46cdf179fd9
CryptoVenetians NFT
When? Aug-11-2021
How much? $5M
Where? ETH
Why? Stolen Private Keys
Link: https://docs.google.com/document/d/1ebAPc0-gZsJAhxUZpoDFZEZCBhaCWzLshAVxmzcwnw0/edit#heading=h.bqti7y3gd1km
DAO Maker
When? Aug-12-2021
How much? $7M
Where? ETH
Why? Stolen Private Keys
Link: https://blocksecteam.medium.com/the-analysis-of-the-daomaker-attack-32365c37e7fc
Ref Finance
When? Aug-14-2021
How much? $3.2M
Where? NEAR
Why? Logic error
Link: https://twitter.com/finance_ref/status/1426649258812448774
Curve Bribe / Whitehack
When? Aug-14-2021
How much? $117K
Where? ETH
Why? Whitehack
Link: https://twitter.com/bantg/status/1426629982328180737
SushiSwap / Whitehack
When? Aug-17-2021
How much? $350M
Where? ETH
Why? Whitehack
Link: https://www.paradigm.xyz/2021/08/two-rights-might-make-a-wrong/
xSurge
When? Aug-17-2021
How much? $4M
Where? BSC
Why? Re-entrancy
Link: https://twitter.com/BlockSecTeam/status/1427482803134894080
Pinecone Finance
When? Aug-18-2021
How much? $17.5K
Where? BSC
Why? Insufficient validation Impact
Link: https://twitter.com/peckshield/status/1428233500260511746
Solend
When? Aug-19-2021
How much? $16K
Where? Solana
Why? Insecure Authentication
Link: https://docs.google.com/document/d/1-WoQwT1QrPEX-r4N-fDamRQ50LM8DsdsOyq1iTabS3Q/edit#
X-Token
When? Aug-30-2021
How much? $4.5M
Where? ETH
Why? Flash-loan
Link: https://rekt.news/xtoken-rekt-x2/
CREAM Finance
When? Aug-30-2021
How much? $18.8M
Where? ETH
Why? Flash-loan
Link: https://rekt.news/cream-rekt/
In hacks alone, excluding PolyNetwork, we saw ~$77.84M gone from various DeFi protocols on different chains. We saw first Solana’s DeFi hack. With the NFT exploding again, hackers are eyeing that market and trying to exploit the protocols.
We also had two whitehacks saving quite a substantial amount of money.
In the next reports, I will also take information from Immunefi to learn how much bug bounties had helped saved each month.
Stay safe out there, and remember that we’re still early in blockchain, and it will take time until the numbers of hacks and their impact will go down.
Thanks for reading, and if you like my writing, you can subscribe to my blog to receive the newsletter. Subscription box below 👇
If the newsletter is not your thing, check out my Twitter @adrianhetman, where I post and share exciting news from the Blockchain world and security.