Ethereum

Prisma Finance

DeFi

April

Tornado

Decentralized finance (DeFi) firm Prisma Finance says there are still $540,000 in funds from accounts yet to revoke the smart contract responsible for last week’s <a href="https://cointelegraph.com/news/prisma-finance-exploited-10-million">$11.6 million exploit</a>.
Meanwhile, the self-claimed “white hat” hacker behind the exploit says they will hold back the return of funds until the firm apologizes and reveals the team’s identity online. 
In a “path forward” post on April 1, core contributor “Frank” <a href="https://gov.prismafinance.com/t/a-path-forward-after-the-security-incident/157" target="_blank" rel="noopener nofollow">said</a>&nbsp;the firm would continue to seek the return of funds, but the top priority is to unpause the protocod and said it needed all users to ensure their wallets and positions were safe first. 
The protocol suffered a multimillion-dollar exploit on March 28, which was later revealed to be the result of two MigrateTroveZap contracts, which were designed to migrate user positions from one trove manager to another, <a href="https://hackmd.io/@PrismaRisk/PostMortem0328" target="_blank" rel="noopener nofollow">according</a> to a post-mortem post from Prisma last updated on March 31.
However, Frank noted that there were still 14 remaining accounts that had yet to revoke the affected smart contract, five of which were still “at risk” with open trove positions totaling over $500,000. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-04/838027ef-0408-4ff9-810d-5e42dadd1e70.jpg" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/PrismaFi/status/1774339387498623185" target="_blank" rel="noopener nofollow">Prisma Finance</a>
 </figcaption>
</figure>
“Of the affected Troves several have revoked the contract containing the vulnerability with ~$540k of collateral still at risk at the time of writing.”
Prisma is a decentralized borrowing protocol that uses “troves” — Ethereum addresses — where users can take out and maintain loans. 
The largest “at risk” address contains $484,380, while the other four carry between $7,120 and $22,080.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-04/50f7b243-2d76-44de-a396-b0fd3a529962.png" alt="" title="">
 <figcaption style="text-align: center;">
 Remaining affected addresses from Prisma’s $11.6 million exploit. Source: Prisma Finance
 </figcaption>
</figure>
Frank explained that part of its “path forward” was to “conserve additional reserves” while Prisma attempted to recover the stolen funds.
A new <a href="https://gov.prismafinance.com/t/a-path-forward-after-the-security-incident/157" target="_blank" rel="noopener nofollow">proposal</a> was made on April 1 to reduce liquidity from POL and staked revenue from vePRISMA. 
Prisma also stressed that the exploited contract was isolated from the core protocol and that it plans to restart it once the remaining user funds are safe.
<h3 data-ct-non-breakable="true" id="id-yourselves-and-publicly-apologize-exploiter-demands">ID yourselves and publicly apologize, exploiter demands</h3>
Meanwhile, the self-claimed “white hat” has accused the DeFi firm of failing to act in good faith and claims the funds won’t be returned unless it makes a public apology. 
Part of that apology involves Prisma holding an online conference, in which the entire team must show their faces with ID and apologize to all users and investors for failing to properly audit its smart contract. 
In a March 30 on-chain message, the exploiter&nbsp;<a href="https://etherscan.io/idm?addresses=0x2d413803a6ec3cb1ed1a93bf90608f63b157507a%2c0xd8531a94100f15af7521a7b6e724ac4959e0a025&amp;type=1" target="_blank" rel="noopener nofollow">wrote</a>:&nbsp;
<blockquote data-ct-non-breakable="true">
 “During that session, you must specifically present the mistake you made, which party audited the smart contract, and your plan to improve security in the future.”
</blockquote>
The exploiter also wants Prisma to acknowledge they have “no responsibilities” in the ordeal and are <a href="https://cointelegraph.com/news/prisma-finance-hack-may-be-whitehat-rescue">only trying to help</a> Prisma rectify its mistake.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-04/9b1fbdfe-fd60-4f45-b34a-a9d2ab1897a5.png" alt="" title="">
</figure>
On-chain messages sent from the hacker to Prisma Finance. Source: Etherscan
Prisma, however, fired back, <a href="https://hackmd.io/@PrismaRisk/PostMortem0328" target="_blank" rel="noopener nofollow">pointing</a> out that the exploiter has yet to return any funds to show good faith either, with the two sides then continuing to argue in on-chain messaging. 
<blockquote data-ct-non-breakable="true">
 “There is little evidence that we can judge you on that you are sincere in your intention to return the assets. Most genuine white hats would have returned at least some of the funds by now.”
</blockquote>
Related:<a href="https://cointelegraph.com/news/white-hat-returns-5-million-curve-finance-hack"> Ethical hacker retrieves $5.4M for Curve Finance amid exploit</a>
Since the attack, blockchain security firms Cyvers and Peckshield observed that the hacker had started swapping the stolen funds to Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>),&nbsp;and about 200 Ether was transferred to the United States Treasury’s Office of Foreign Assets Control-<a href="https://cointelegraph.com/news/blockchain-association-remove-tornado-cash-sanctions">sanctioned cryptocurrency mixer Tornado Cash</a>.
Prior to the exploit, Prisma Finance had about $220 million in total value locked on its protocol, but that figure has plummeted to $87 million,&nbsp;<a href="https://defillama.com/protocol/prisma-finance" target="_blank" rel="noopener nofollow">according</a> to DefiLlama.
Magazine: <a href="https://cointelegraph.com/magazine/ethics-101-crypto-projects-negotiate-hackers/">Should crypto projects ever negotiate with hackers? Probably</a>

Prisma Finance says $540K still at risk, hacker demands team reveal themselves

Table of Contents

Cointelegraph

Other articles published on Apr 1, 2024

Bitget Lists Another Anticipated Memecoin: ANDY on SOL (ANDY) (1 Apr)

Bitcoin (BTC) Scores Historic Monthly Close

Jupiter (JUP) Recovers From All-Time Low with 41% Surge

Binance CEO Secretly Visits Korea to Engage Regulators About Gopax

Kelexo entices Ripple, Cosmos investors with promise of major gains

BlockDAG Presale Triumph of $11.4M Leads Crypto’s 2024 Outlook, Surpassing SEI Growth and MANA’s ...

Join our free newsletter for daily crypto updates!