Compound

Sonne Finance

Tornado Cash

Lending protocol Sonne Finance was forced to pause operations after suffering a hack that drained $20 million worth of cryptocurrencies from the market.
On May 14, around 10:30 pm UTC, Web3 security firm Cyvers <a href="https://twitter.com/CyversAlerts/status/1790509607074349448" target="_blank" rel="noopener nofollow">detected</a> an ongoing attack on Sonne Finance’s USD Coin (<a href="https://cointelegraph.com/usdc-price-index">USDC</a>) and Wrapped Ether (WETH) contracts. 
However, when Sonne Finance became <a href="https://medium.com/@SonneFinance/post-mortem-sonne-finance-exploit-12f3daa82b06" target="_blank" rel="noopener nofollow">aware</a> of the situation 25 minutes later, the hacker had already <a href="https://optimistic.etherscan.io/tx/0x9312ae377d7ebdf3c7c3a86f80514878deb5df51aad38b6191d55db53e42b7f0" target="_blank" rel="noopener nofollow">stolen</a> $20 million in WETH, Velo (VELO), soVELO and Wrapped USDC (USDC.e).
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/f546d7f3-cd46-4f10-85f9-19e42c03cf53.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/SonneFinance/status/1790535383005966554" target="_blank" rel="noopener nofollow">Sonne Finance</a>
 </figcaption>
</figure>
On May 15 at 12:11 am UTC, Sonne Finance announced on X that “All markets on Optimism have been paused.” Soon after, the protocol <a href="https://twitter.com/SonneFinance/status/1790547762230006059" target="_blank" rel="noopener nofollow">partnered</a> with Cyvers to investigate the situation further.
Sonne is currently exploring all options to retrieve the stolen funds, including negotiating a bug bounty for the hacker. In such situations, the hacker returns most of the stolen funds and keeps roughly 10% of the loot as a reward for finding a security flaw. 
However, the hacker seems to be in no mood for negotiations. According to blockchain investigator PeckShield, the exploiter has already moved a large chunk of the loot ($7.8 million) to a new wallet address.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/0bed5fef-4753-45d2-a4b0-5e29167070b5.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/PeckShieldAlert/status/1790582472943821116" target="_blank" rel="noopener nofollow">PeckShield</a>
 </figcaption>
</figure>
The exploiter then swapped 59 WBTC for roughly 1,185 Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>) and 183,000 Dai (<a href="https://cointelegraph.com/dai-price-index">DAI</a>). The move suggests an intent to siphon the stolen funds through a privacy protocol like Tornado Cash to deter traceability.
Sonne Finance’s post-mortem found that a donation attack was conducted on Sonne’s Compound v2 forks, which had a known bug, <a href="https://twitter.com/GiantBabyCorn/status/1790564550770860169" target="_blank" rel="noopener nofollow">according</a> to X community member PoorBabyCorn. 
They accused Sonne Finance of using Compound v2 despite knowing the risks and asked, “If this isn’t a premeditated backdoor, what is?”
In parallel, the main hedge fund of crypto institutional investment firm BlockTower Capital has reportedly been exploited and partially drained.
The funds have not been recovered, and BlockTower has employed blockchain forensic analysts to trace the funds and determine how they were breached. The exploiter has also not been arrested, Bloomberg <a href="https://www.bloomberg.com/news/articles/2024-05-15/crypto-investment-firm-blocktower-capital-suffers-losses-in-hack" target="_blank" rel="noopener nofollow">reported</a> on May 15, citing people familiar with the matter.
Related: <a href="https://cointelegraph.com/news/poloniex-hack-50m-eth-tornado-cash">Stolen Poloniex Ether worth $53M never made it back to the exchange</a>
Its partners have been informed about the incident. It reportedly has $1.7 billion in assets under management.
BlockTower did not immediately respond to Cointelegraph’s request for comment.
In February 2023, BlockTower seemingly lost around $1.5 million in the <a href="https://cointelegraph.com/news/dexibleapp-aggregator-hacked-for-2m-via-selfswap-function">$2 million exploit</a> of the multichain exchange aggregator Dexible.
Dexible said that around 85% of the stolen funds were from a “few big whales.” On-chain intelligence platform Arkham Intelligence <a href="https://platform.arkhamintelligence.com/explorer/entity/blocktower-capital" target="_blank" rel="noopener nofollow">labeled</a> a wallet drained of $1.5 million as belonging to BlockTower.
Magazine: <a href="https://cointelegraph.com/magazine/sic-ais-on-each-other-artificial-intelligence-threat-alignment-david-brin-author/">‘Sic AIs on each other’ to prevent AI apocalypse: David Brin, sci-fi author</a>

$20M exploit cripples Sonne Finance, hacker in no mood for negotiation

Cointelegraph

Other articles published on May 15, 2024

Render (RNDR) Price Uncertainty Intensifies As Bears Gain Power!

Investor Borong 70.000 BTC Jelang Data Inflasi AS, Ada Apa?

CROSS THE AGES Raises $3.5M in Equity Round Led by Animoca Brands, and Lists on Major Exchanges

Bitcoin Leads Crypto Market Surge

ETFSwap (ETFS) Crosses 4,000 Users With $1.5 Million Raised

State Of Wisconsin Invests $164 Million In Spot Bitcoin ETFs As ”Big Fish Institutions” Endorse BTC

Join our free newsletter for daily crypto updates!