SIR.trading Founder Begs Hacker to Return $255K of the Stolen $355K

The founder of the recently compromised decentralised finance (DeFi) protocol SIR.trading has issued a heartfelt appeal to the attacker, urging them to return 70% of the stolen funds to avoid the protocol’s collapse.

In a 31 March onchain message, “Xatarrer,” the pseudonymous founder, pleaded with the hacker after a $355,000 exploit on 30 March:

“Here is my proposal, keep $100k as a fair share for your critical bug find, and return the remaining."

Adding:

“We’ll call it even. No legal games, no drama.”

Xatarrer shared that the protocol was built over four years of late-night coding and funded by $70,000 from friends and supporters, without any external venture capital:

“We grew to $400k TVL organically without any advertising. If you keep 100% of the funds, there is no chance for us to survive.”

Despite the devastating loss, Xatarrer commended the sophistication of the hack, describing it as "almost beautiful if it wasn’t for all the funds people lost."

However, the hacker has yet to respond and has already routed the stolen assets through the Ethereum privacy protocol, Railgun, as shown by data from Etherscan.

Initially, Xatarrer expressed optimism, stating the team would continue to operate SIR.trading despite the setback.

It stated on 1 April:

“We’ve already started planning our next steps. Those impacted by the hack will not be forgotten.”

New Feature in Ethereum’s Dencun Upgrade Exploited in Recent Hack

The hacker exploited a vulnerability in SIR.trading's “Vault” contract, which relied on Ethereum’s newly introduced transient storage feature from the March 2024 Dencun upgrade.

By manipulating a callback function, the attacker replaced the legitimate Uniswap pool address with one under their control, allowing them to redirect funds to their own wallet.

The attacker then repeatedly invoked the callback function, draining the protocol’s total value locked (TVL) until all funds were stolen.

The transient storage feature, designed to reduce gas fees compared to regular storage, was intended to make transactions more cost-effective but inadvertently opened the door to this exploit.

SIR.trading, marketed as a safer leveraged DeFi protocol aimed at addressing volatility and liquidation risks, has now been severely impacted.

In related news, blockchain security firm CertiK reported a decline in total crypto losses from exploits and scams, which fell to $28.8 million in March.

Of that, $4.8 million was recouped following the return of stolen funds from the 1inch Resolver hack.