Raft

David

Read

Tornado

<p class="is-style-lead">The defi platform Raft has temporarily suspended the minting of its R stablecoin due to a security vulnerability that resulted in a substantial loss.&nbsp;</p> 
<p>The company is currently investigating the incident and has promised to keep its users updated. Existing users, however, can continue with loan repayments and collateral retrieval.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">We are aware of a potential security vulnerability. <br><br>We are currently investigating and will provide an update as soon as we can.</p>— Raft (@raft_fi) <a href="https://twitter.com/raft_fi/status/1723057566664548623?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">November 10, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Raft co-founder David Garai confirmed the attack on their platform, which saw the assailant minting R tokens and draining <a href="https://crypto.news/learn/what-is-an-automated-market-maker-amm/" data-type="link" data-id="https://crypto.news/learn/what-is-an-automated-market-maker-amm/" target="_blank" rel="noreferrer noopener">automated market maker</a> liquidity while withdrawing collateral from Raft concurrently.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">There's been an exploit situation for <a href="https://twitter.com/raft_fi?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@raft_fi</a> where the exploiter minted R (which was then sold to drain AMM liquidity), and also managed to withdraw collateral at the same time<br><br>We are investigating – post-mortem will follow soon</p>— DG (@davgarai) <a href="https://twitter.com/davgarai/status/1723065357445775507?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">November 10, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The defi lending platform issues the R stablecoin collateralized by liquid staking ETH derivatives.&nbsp;According to Garai, the company is now focused on securing its users’ operations and restoring stability to its platform.</p> 
<p> You might also like: <a href="https://crypto.news/poloniex-hot-wallet-hacked-with-losses-reportedly-over-33m/"> Poloniex hot wallet hacked with losses reportedly over $33m </a> </p> 
<p>The disruption caused the R stablecoin to significantly drop its price from $1 to $0.18. Per <a href="https://www.coingecko.com/en/coins/r#:~:text=The%20price%20of%20R%20(R)%20is%20%240.852902%20today%20with%20a,a%20market%20cap%20of%20%2410%2C838%2C091." target="_blank" rel="noreferrer noopener">CoinGecko</a>, at the time of writing, the cryptocurrency was trading at $0.057965, which is 92.3% below its previous level.</p> 
<figure class="wp-block-image">
 <img decoding="async" loading="lazy" width="1200" height="1200" src="https://crypto.news/app/uploads/2023/11/image-17.png" alt="Raft halts stablecoin minting following security breach - 27" class="wp-image-14214839">
 <figcaption class="wp-element-caption">
  R stablecoin price chart | Source: CoinGecko
 </figcaption>
</figure> 
<p>According to on-chain analysts, a hacker allegedly exploited the system, resulting in the burning of a significant amount of ether (<a href="https://crypto.news/price/ethereum/" target="_blank" rel="noreferrer noopener">ETH</a>).&nbsp;</p> 
<p>However, a twist of fate saw the hacker presumably suffering a setback due to a coding error. The ether, instead of directing to the hacker’s address, was sent to a null address, making them irretrievable.</p> 
<p>The on-chain data shows the hacker drained 1,577 ETH from Raft and then sent 1,570 ETH to a burn address.&nbsp;</p> 
<p>The exploiter’s crypto wallet was left with just 7 ETH, a net loss compared to a <a href="https://platform.arkhamintelligence.com/explorer/address/0xc1f2b71A502B551a65Eee9C96318aFdD5fd439fA" target="_blank" rel="noreferrer noopener">reported</a> 18 ETH initially funded via the <a href="https://crypto.news/tornado-cash-case-crypto-anonymity-vs-regulation/" target="_blank" data-type="link" data-id="https://crypto.news/tornado-cash-case-crypto-anonymity-vs-regulation/" rel="noreferrer noopener">sanctioned</a> crypto mixer service, Tornado Cash.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">absolutely unhinged<br>1. hacker pulled 18 ETH from tornado cash<br>2. hacked a total of 1,577 ETH<br>3. burned 1,570 ETH and sent remaining 7 ETH to themselves<br>4. After fees, they're left with 14 ETH<br><br>So total profit after fees is -4 ETH<br><br>mf might go to jail to LOSE 4 ETH</p>— 0xngmi (@0xngmi) <a href="https://twitter.com/0xngmi/status/1723073285263380924?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">November 10, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Igor Igamberdiev, the Head of Research at <a href="https://crypto.news/wintermute-highlights-talent-movement-between-crypto-and-traditional-finance/" target="_blank" rel="noreferrer noopener">Wintermute</a>, noted that the hacker minted 6.7 uncollateralized R stablecoin and converted it into ether.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">1/6<br><br>Sad, but <a href="https://twitter.com/raft_fi?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@raft_fi</a> was exploited, and the attacker was able to mint 6.7 uncollateralized R stablecoin<br><br>The twist is that they converted them into ETH, which was sent to the null address, but first things first👇<a href="https://t.co/q6U5fyRek9" target="_blank">https://t.co/q6U5fyRek9</a></p>— Igor Igamberdiev (@FrankResearcher) <a href="https://twitter.com/FrankResearcher/status/1723099971824582713?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">November 10, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>However, due to the coding error, the ether ended up in the null address.</p> 
<p> Read more: <a href="https://crypto.news/australian-exchange-coinspot-reportedly-hacked-for-2m/"> Australian exchange CoinSpot reportedly hacked for $2m </a> </p>

Raft halts stablecoin minting following security breach

crypto.news

Other articles published on Nov 12, 2023

Air Force Chiefs Confront Era of AI and Technological Disruption

Avalanche Shines With A 31% Rally – Can AVAX Bulls Maintain Push To $22?

Is Polkadot (DOT) About To Skyrocket To Unseen Heights?

FTX Former Execs Team Up To Build A New Crypto Exchange in Dubai

Shiba Inu (SHIB) Unleashes Exciting New Identity Feature, Igniting Anticipation for Monumental Gr...

Solana Price Declines As It Is Unable To Hold Above The $64 Peak

Join our free newsletter for daily crypto updates!