On November 1st, the multichain protocol resumed operations for the first time in almost four months. Validators confirmed its first transactions since a June 2023 exploit that drained a staggering $120 million and brought the entire project to a halt. Tragically, users immediately suffered another $1 million exploit.
In the early days after the June hack, some multichain supporters considered the possibility that administrators had removed stablecoins and other liquidity pools to protect the protocol. Of course, investigators doubted that protocol administrators would withdraw liquidity from cross-blockchain bridges to protect user funds.
Finally, the administrators admitted the violation. Yes, someone had stolen the money.
Unfortunately, thieves continue to steal from Multichain users. When the multichain protocol resumed this week, there were hours of near-risk-free arbitrage opportunities. Someone made $1 million through a simple cross-chain arbitrage trade that arose from Multichain’s service restoration.
Although preparations for a relaunch took four months, developers clearly did not adequately test the protocol to protect regular users.
A few minutes after the $1 million theft, the protocol stopped operating again.
The secret relaunch of the Multichain protocol
Formerly known as Anyswap, Multichain’s block explorer showed transactions being deleted from a long queue earlier this week. Some users have indicated that their transactions are still pending. For example, a Bitcoin to Polygon transaction failed.
Everyone wondered why the protocol never called for advance notice.
Yesterday, security researchers at Cyvers Alerts clarified that most four-month-old transactions remain in the queue. Current transactions seemed to gain priority.
Many users were understandably concerned about the unannounced restart of the protocol. There was nothing about the relaunch in Multichain’s X account. Before resuming operations, Multichain had only last published on X on October 5th.
For comparison, Multichain’s former CEO and co-founder, known only as Zhaojun, disappeared in May 2023 amid claims that Chinese authorities had arrested him. Chinese authorities also arrested several multichain developers and Zhaojun’s sister. Authorities seized computers, hardware wallets, mnemonic phrases, and a multi-party computing wallet critical to Multichain’s operations. Multichain later admitted the incident.
1. On May 21, 2023, Multichain CEO Zhaojun was taken away from his home by Chinese police and has had no contact with the global Multichain team since then. The team contacted the MPC node operators and learned that their operational access keys for MPC node servers…
— Multichain (formerly Anyswap) (@MultichainOrg) July 14, 2023 Multichain finally admitted in July what users had suspected since May.
Circle has blacklisted three addresses that received USDC through the hack. Binance Smart Chain has suspended deposits from some manipulated multichain wallets. Although these measures were helpful, they were not enough to save users from massive losses.
Re-release of another $1 million exploit
It remains unclear who restarted the protocol this week, who stole the liquidity, and who shut down operations after stealing $1 million.
Apparently someone with private keys to the multi-party computation contracts restarted it. Zhaojun was reportedly the only person with access to these contracts, but he may have passed on (or lost) the keys after his arrest in May by Chinese authorities.
Browser extensions like MetaMask are still publishing a warning about the June exploit for users connecting to the Multichain protocol. MetaMask advises caution when connecting to its front-end website or protocol.
Read more: Crypto token MULTI crashes as Multichain confirms CEO missing
In summary, someone temporarily restored the functionality of the Multichain protocol, allowing a million-dollar arbitrage trade to be processed. This allowed some current transactions to be carried out and would be useful if someone had access to the core protocol’s multi-party computing wallet.
Multichain Protocol did not inform users about the relaunch and said little about it on its official social media accounts. The last post on X is from October 5th.
Do you have a tip? Send us an email or ProtonMail. For more in-depth news, follow us on X, Instagram, Bluesky and Google News or subscribe to our YouTube channel.
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.