© 2024 AnChain.AI. All Rights Reserved | Privacy Policy
.png)
Suffice to say October 2022 has further solidified its dubious legacy, already ranking comfortably among the worst ever in the history of DeFi and cryptocurrency at large.
In the midst of a month which has already witnessed over $700 million lost to DeFi attacks, including the $570 million Binance Hack, Moola Market has become the latest multi-million dollar victim.
On October 18th, 2022, Moola Market was exploited, with hackers making off with roughly $9.1 million spread across a number of different tokens. Within hours following the exploit, the attacker has returned over 93% of the more than $9 million worth of cryptocurrencies they exploited from the Celo blockchain-based decentralized finance (DeFi) lending protocol Moola Market.
Moola Market is a non-custodial liquidity protocol on the Celo ecosystem that is democratizing access to yield and credit.
The AnChain.AI threat intelligence team has identified the attacker’s wallet address as:
The stolen funds are broken down as follows, and are being continuously monitored by the AnChain team:
TokenUSD8.8 million $CELO$6.6 million765k $cEUR$0.7 million1.8 million $MOO$1.2 million644k $cUSD$0.6 million
Around October 18, 2022 at 04:02:09 PM, the attacker funded the wallet 0x5dae2c3d5a9f35bfaf36a2e6edd07c477f57789e with a total of 182,087.399 CELO valued at $134,744.68 at the time of the transaction.
About 1,000,000.00 CELO valued at $740,000.00 at the time of the transactions was subsequently transferred from 0x5dae2c3d5a9f35bfaf36a2e6edd07c477f57789e to the following wallet addresses:
The attacker then moved the funds to a second cluster of addresses:
After which the funds convened at 0xd868839E0964052c3ff70ec626A30516d73C799d before making a hop to the primary Moola Market exploiter wallet, 0x95B5579b323Ddc6cd290Bd4DA6e56BA019588EfC.
Since then, around 8,126,912.722279805125286141 CELO valued at $6,013,915.41in USD has been transferred to 0xd7f77169d5e6a32c5044052f9a49eb94697b25ed.
The anatomy of the attack breaks down as follows:
Additional source: https://rekt.news/moola-markets-rekt/
Moola Market attempted to negotiate with the attackers, stating that it would negotiate a bounty payment in return for the funds.
Just hours after the initial confirmation of the exploit, the attackers returned over 93% of the funds exploited, with the attacker seemingly keeping the rest. This made the bug bounty around $500,000.
“Following today’s incident, 93.1% of funds have been returned to the Moola governance multi-sig. We have continued to pause all activity on Moola, and will follow up with the community about next steps, and to safely restart operations of the Moola protocol. (1/2) https://t.co/UsdN44X70X”
— Moola Market (@Moola_Market) October 18, 2022
While the $9.1 Million dollar price tag of this exploit and the eventual resolution may soften the blow when compared to the $100 million plus disasters that have already rocked the Web3 ecosystem in recent months, it does represent the continuation of a worrying trend. It has become all too clear that as innovation and capital in DeFi continue to balloon, so too does the motivation of hackers, scammers, and other bad actors.
Auditing on the basis of code alone is no longer enough. Properly securing a smart contract platform requires thorough a examination of the functionality and logic as well.
Interested in enhancing the security of your DeFi project? Contact us at info@anchain.ai to schedule a demo, and for the latest updates follow us on Twitter @AnChainAI
© 2024 AnChain.AI. All Rights Reserved | Privacy Policy
.png)