The central theses
- MM.Finance, the largest decentralized exchange on Cronos, suffered a $2 million cyberattack late Wednesday.
- The attacker exploited a DNS vulnerability and injected a malicious contract address into the project website’s frontend to redirect funds to their own wallet.
- MM.Finance says it traced the culprit to the OKX exchange and warned it would contact the FBI if the 90% of the funds are not returned within 48 hours.
Share this article
Mad Meerkat Finance, the largest ecosystem of DeFi applications on the Cronos blockchain, has been mined for around $2 million.
MM.Finance suffers a $2 million front-end attack
The largest decentralized exchange on Cronos has been hacked.
MM.Finance, an ecosystem of DeFi applications and the largest decentralized exchange on the Cronos blockchain, suffered a $2 million front-end attack. The project reported the incident late Thursday after the attacker breached the app’s front end and began moving funds to its address.
We checked and there is a frontend violation. Please do not make any transactions or your funds will be sent to the exploiter wallet. We will disable the frontend as soon as possible.
— MM.Finance — #1 Defi Ecosystem on #Cronos (@MMFcrypto) May 4, 2022
“We checked and there is a frontend violation. Please do not make any transactions or your funds will be sent to the exploiter wallet. We will deactivate the frontend as soon as possible,” MM.Finance tweeted. According to a post-mortem report released by the project today, the attacker exploited a DNS vulnerability to change the router contract address in the project’s hosted files and injects a malicious contract address into the project’s website front-end a. The malicious contract then redirected the funds to the attacker’s wallet when someone tried to trade, add or remove liquidity on MM. The decentralized exchange of finances. On-chain data shows the hacker stole around $2 million worth of crypto assets before MM.Finance discovered the exploit. Almost immediately after stealing the funds, the perpetrator bridged them to Ethereum using the cross-chain routing protocol multichain and deposited them with Tornado Cash– a privacy protection tool that helps users hide their transaction history.
MM.Finance said this morning it has already happened traced the attacker back to the central exchange OKX, which lets users go through a KYC process when registering. KYC, which stands for Know Your Customer, is a process that requires financial institutions such as crypto exchanges to collect customer data such as maiden names and identification. This means that if the attacker didn’t use fake IDs when logging into OKX, the exchange likely has a way of tracking their true identity.
“We traced your funding to the OKX exchange,” MM.Finance said, before warning the hacker that he would contact the FBI if he didn’t return 90% of the stolen funds within 48 hours. “With all of this information, we have more than what we need to get this information to the @FBI,” they said. “If you decline, we’ll just sleep less and escalate the costs, which we’re already very accustomed to at MM. Your movement.” It has since been confirmed that all affected users will be refunded for any lost funds, while OKX CEO Jay Hao has stated that his team is investigating the incident.
Based on Data MM.Finance, powered by DeFi Llama, has not lost a significant amount of liquidity, with the total value locked still standing at around $802 million. Interestingly, the project’s native token MMF has not met with much success either, which is unusual for newly exploited protocols. The token recouped its losses after a small initial drawdown and is currently trading down only 0.1% on the day.
Disclosure: At the time of writing this article, the author of this article owned ETH and several other cryptocurrencies.
Share this article
The information on this website or information obtained through this website is obtained from independent sources which we believe to be accurate and reliable, but Decentral Media, Inc. makes no representations or warranties as to the timeliness, completeness or accuracy of any information on or through this website . Decentral Media, Inc. is not an investment advisor. We do not provide personalized investment advice or any other financial advice. Information on this website is subject to change without notice. Some or all information on this website may be or become out of date, incomplete or inaccurate. We have the right, but not the obligation, to update any information that is out of date, incomplete or inaccurate.
You should never make an investment decision about any ICO, IEO or any other investment based on the information on this website, and you should never interpret or otherwise rely on the information on this website as investment advice. We strongly encourage you to consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO or any other investment. We do not accept compensation in any form for analysis or coverage of ICO, IEO, cryptocurrency, currency, tokenized sales, securities or commodities.
See full terms and conditions.
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.