Blockchain security incidents in April: Hackers caused losses of $101 million

Author: Shenzhen Lingshi Technology

According to statistics from some blockchain security risk monitoring platforms, in April 2024, the amount of losses from various security incidents continued to decline compared with March. More than 32 typical security incidents occurred in April, and the total loss amount caused by hacker attacks, phishing scams and Rug Pulls reached 101 million US dollars, a decrease of about 36% from March. Among them, the attack incidents were about 52.56 million US dollars, a decrease of about 55%; the phishing scam incidents were about 11.4 million US dollars, a decrease of about 69%; the Rug Pull incidents were about 37.05 million US dollars, an increase of about 624%.

In addition, there are some specific security incidents and new news, which will be described in detail below.

Hacker Attacks 

Typical Security Incidents9 

(1) On April 1, the DeFi protocol OpenLeverage was attacked due to a contract vulnerability, resulting in a loss of approximately US$230,000.

(2) On April 1, the ATM tokens on the BNB Chain were attacked due to a contract vulnerability, resulting in a loss of approximately US$180,000.

(3)  On April 2, the decentralized exchange FixedFloat was attacked again, losing about $2.8 million. FixedFloat said that hackers exploited a vulnerability in its third-party service.

(4)  On April 12, the BASE ecological project SumerMoney was attacked due to a contract vulnerability and lost about $350,000.

(5)  On April 12, the Zest Protocol project on the Stacks chain was attacked by price manipulation, and the attacker removed 324,000 STX (about $1 million) from the protocol. Zest Protocol stated that this part of the loss will be compensated by the protocol treasury and users will be fully compensated.

(6)  On April 15, the BASE ecosystem RWA project Grand Base lost approximately $2 million due to the leak of the deployer's private key.

(7)  On April 19, the Hedgey Finance project was attacked on the Ethereum and Arbitrum chains due to contract vulnerabilities, resulting in losses of $44.7 million.

(8)  On April 24, the YIEDL project on the BNB Chain was attacked due to a contract vulnerability, resulting in a loss of approximately $300,000.

(9)  On April 24, Saita Chain's cross-chain bridge project Xbridge was attacked due to a contract vulnerability, resulting in a loss of at least $200,000.

(10) On April 25, the NGFS token on the BNB Chain was attacked due to a contract vulnerability, resulting in a loss of approximately $190,000.

(11)  On April 26, the cross-chain lending protocol Pike Finance was attacked and lost about $300,000. The hacker drained the USDC on the Ethereum, Arbitrum and Optimism chains through forged CCTP messages.

Rug Pull / Phishing Scam

Typical Security Incidents6

(1) On April 2, a Rug pull occurred on the Solareum blockchain on the Solana chain, and the deployer made a profit of US$520,000.

(2)  On April 4, CondomSOL on the Solana chain had a Rug pull, and the deployer made a profit of US$920,000.

(3)  On April 11, a certain address starting with 0x5ea8 lost approximately US$840,000 on the Base chain due to a phishing scam.

(4)  On April 11, a certain address starting with 0x05f4 lost approximately US$1.2 million on the Base chain due to a phishing scam.

(5)  On April 19, a certain address starting with 0x5789 lost approximately US$770,000 due to a phishing scam.

(6)  On April 20, the decentralized betting platform ZKasino experienced a Rug pull, and users were unable to withdraw funds. The project team deposited 33 million US dollars of user funds into the pledge agreement Lido.

Cryptocurrency Crime

Typical Security Incidents 15

(1)  On April 20, the Hong Kong Customs successfully smashed a money laundering group involving more than HK$1.8 billion and arrested three people. According to the investigation, the gang opened multiple local companies and multiple bank accounts to handle more than 1,000 transactions, including funds transferred from virtual currency trading platforms.

(2)  On April 23, the Linyi County Public Security Bureau of Shandong Province successfully destroyed a criminal gang that used the purchase of virtual currency to launder money for overseas fraudsters through precise analysis and judgment. A total of 6 criminal suspects were arrested, and the funds involved exceeded 2 million yuan.

(3)  On April 16, the Dantu District People's Court of Zhenjiang City pronounced a verdict on the case of Wang Mou organizing and leading an online pyramid scheme. Wang Mou is the first "red notice" person sentenced by the Zhenjiang Public Security Bureau of Jiangsu Province. In March 2021, the Dantu Public Security Bureau of Zhenjiang found that a virtual currency platform called moom was suspected of online pyramid schemes. Subsequently, the police arrested 12 suspects involved in the case in many places. The main culprit Wang Mou fled abroad, but in May 2023, under the continuous pursuit and persuasion of the police, Wang Mou surrendered and returned to China. At the time of the incident, the platform had more than 100,000 registered members, 1,000 levels, and the amount involved exceeded 100 million yuan.

(4)  On April 7, Italy, Austria, Romania and Slovakia took joint action to arrest 22 people, accusing them of suspected involvement in the EU COVID-19 recovery fund fraud. In this arrest operation, the police seized and confiscated more than 600 million euros in assets, including luxury sports cars, watches, jewelry and virtual currencies.

(5)  On April 19, a Manhattan jury in New York found Mango Markets attacker Avi Eisenberg guilty of fraud and market manipulation. New York District Court Judge Arun Subramanian will sentence him on July 29. He is expected to face up to 20 years in prison. It is reported that in October 2022, Mango Markets was attacked by Avi Eisenberg and lost $110 million in crypto assets.

(6)  Taiwanese prosecutors have recommended sentences of at least 20 years in prison for four main suspects in a fraud and money laundering case related to cryptocurrency trading platform ACE Exchange. Prosecutors currently believe that more than 1,200 people were defrauded, with total estimated losses of NT$800 million (US$24.56 million).

(7)  On April 25, Jebara Igbara, also known as “Jay Mazini,” was sentenced by U.S. District Judge Frederic Block to seven years in prison and ordered to forfeit $10 million for his involvement in multiple cryptocurrency-related fraud cases. Igbara, 28, operated a Ponzi scheme targeting Muslims through his company Halal-Capital LLC. He claimed to be a successful cryptocurrency millionaire on social media such as Instagram, and deceived investors by offering cryptocurrency prices above the market and sending fake wire transfer confirmation pictures, ultimately defrauding at least $8 million.

(8) Shanxi police cracked a major case of infringement of citizens' personal information, eradicated a major new type of cybercrime gang that used virtual currency to buy and sell citizens' information on overseas platforms, arrested a total of 7 suspects, froze more than 30 million yuan in funds involved in the case, and seized more than 30 mobile phones and computers involved in the case.

(9) According to the U.S. Department of Justice, 45-year-old Charles O. Parks III is suspected of stealing $3.5 million worth of cloud computing services and mining $1 million worth of cryptocurrency through a so-called "cryptojacking" scheme. According to official government information, Parks is suspected of defrauding two "well-known" cloud computing providers, conducting wire fraud, money laundering and illegal currency transactions.

(10)  On April 14, Russian police seized more than 3,200 crypto mining devices in a raid on four large “illegal” data centers in Siberia. Police have filed criminal charges against the operators of the mining centers. It is estimated that the miners stole a total of $2.1 million worth of electricity from the Novosibirsk power grid.  

(11)  On April 13, according to a report by Xinmin Evening News, a man defrauded three “friends” of a total of more than 1 million yuan in the name of investing in virtual currency.

(12)  On April 12, the U.S. Attorney for the Southern District of New York announced that hacker SHAKEEB AHMED was formally sentenced by a U.S. District Judge to three years in prison for hacking into two separate decentralized cryptocurrency exchanges and stealing more than $12 million worth of cryptocurrency.

(13)  On April 12, according to South Korean media YTN, a suspect in his 40s met a victim near Samseong Station in Seoul and offered to sell tokens at a price below the market price, then wielded a blunt instrument and stole 500 million won in cash and fled. Previously, three men in their 30s were arrested in Yeoksam-dong, Seoul for stealing 550 million won in cash by using token trading as bait, but police believe they have no connection with the suspect.

(14)  In October 2023, a wealthy Chinese businessman was kidnapped at gunpoint at a well-known golf course in the UK. He was threatened with a knife, beaten and locked in a cage for more than 30 hours by a crypto extortion gang, who demanded $15 million in Bitcoin. Recently, the suspects in the case are on trial.

(15)  On April 24, the co-founder of the crypto mixing service Samourai Wallet was arrested on suspicion of laundering $100 million from Silk Road and other illegal markets.

Summary

From the analysis of the above multiple events, although the amount of losses from various blockchain security incidents continued to decline in April, there was still a loss of $46.93 million from contract vulnerability exploitation.

Among them, the biggest security incident this month was the attack on Hedgey Finance due to a contract vulnerability, resulting in a loss of approximately 44.7 million USD, which accounted for 85% of the total losses from hacker attacks that month.

The Zero Hour Technology Security Team recommends that project owners always remain vigilant and find professional security companies to conduct audits and conduct project background checks before the project goes online.

Note:

The content of this article is collected and collated from public materials.

Important reminder: This article only collates industry information and does not constitute any investment advice or guarantee.