WETH

Sonne Finance

Tornado Cash

Optimism

Tornado

<h3 class="wp-block-heading" id="lending-protocol-sonne-finance-halted-operations-after-a-hack-drained-20-million-in-cryptocurrencies-including-weth-and-usdc">Lending protocol Sonne Finance halted operations after a hack drained $20 million in cryptocurrencies, including WETH and USDC.</h3> 
<h2 class="wp-block-heading" id="the-attack-timeline">The Attack Timeline</h2> 
<p>On <a href="https://twitter.com/CyversAlerts/status/1790509607074349448" target="_blank" rel="noopener">May 14</a>, around 10:30 pm UTC, Web3 security firm Cyvers detected an ongoing attack on Sonne Finance’s USD and Wrapped Ether (WETH) contracts. Initially, the attacker had only stolen $3 in cryptocurrency. However, Sonne Finance only became aware of the issue 25 minutes later. By that time, $20 million worth of WETH, Velo (VELO), soVELO, and Wrapped USDC (USDC.e) had already been drained.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
   <p lang="en" dir="ltr"><img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">ALERT<img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f4f7.png" alt="📷" class="wp-smiley" style="height: 1em; max-height: 1em;">We have detected an attack on <a href="https://twitter.com/SonneFinance?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@SonneFinance</a>, $3 million have been stolen from their USDC and WETH contracts.<br> <br>Please contact us for more information. <a href="https://t.co/tA4Heigfj7" target="_blank">pic.twitter.com/tA4Heigfj7</a></p>— 
   <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> Cyvers Alerts 
   <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@CyversAlerts) <a href="https://twitter.com/CyversAlerts/status/1790509607074349448?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">May 14, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="initial-response">Initial Response</h2> 
<p>On May 15 at 12:11 a.m. UTC, Sonne Finance made a vague announcement on <a href="https://twitter.com/SonneFinance/status/1790535383005966554" target="_blank" rel="noopener">X</a>, stating, “All markets on Optimism have been paused” and that “Markets on Base are safe.” They assured users that more information would be provided “with time.” Soon after, the protocol partnered with Cyvers to investigate the situation further.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
   <p lang="en" dir="ltr">All markets on Optimism have been paused. <br><br>Markets on Base are safe. <br><br>We'll provide more information with time.</p>— Sonne Finance (@SonneFinance) <a href="https://twitter.com/SonneFinance/status/1790535383005966554?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">May 15, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="how-sonne-finance-was-exploited">How Sonne Finance Was Exploited</h2> 
<p>Three hours after their initial announcement, Sonne explained the situation further in a press release. The Optimism chain of Sonne Finance was exploited through a known donation attack on Compound v2 forks. Previously, measures were in place to combat the issue with 0% collateral factors, adding collateral, and burning them, before gradually increasing the collateral factors based on proposals.</p> 
<p>However, a recent proposal was approved to integrate VELO markets into Sonne. Transactions were scheduled on a multi-sig wallet with a 2-day timelock. The exploit occurred as the timelock ended, <a href="https://btc-pulse.com/interactive-brokers-now-allows-uk-trade-crypto/">allowing </a>the hacker to execute transactions for market creation and adding collateral factors. After executing the markets undetected, the attacker was able to exploit the protocol for $20 million. However, the remaining $6.5M was saved by adding $100 worth of VELO to the markets.</p> 
<h2 class="wp-block-heading" id="the-aftermath-and-recovery-efforts">The Aftermath and Recovery Efforts</h2> 
<p>Sonne Finance is working to recover the stolen funds, considering a bug bounty for their return. Usually, a 10% reward would be given to an exploiter for discovering a security flaw. However, it seems unlikely the hacker will comply. According to blockchain investigator PeckShield, the exploiter has <a href="https://btc-pulse.com/legal-experts-weigh-in-on-case-against-roger-ver/">already </a>moved $7.8 million to a new wallet address. The exploiter then swapped 59 WBTC for roughly 1,185 Ether and 183,000 Dai, suggesting an intent to launder the stolen funds through a privacy protocol like Tornado Cash.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
   <p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#PeckShieldAlert</a> <a href="https://twitter.com/SonneFinance?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@SonneFinance</a> exploiter-labeled address has transferred $7.8M worth of cryptos, including 100 <a href="https://twitter.com/search?q=%24WBTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">$WBTC</a> &amp; 556.1 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">$ETH</a>, to a new address 0x6277…4c07 <a href="https://twitter.com/hashtag/Optimism?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#Optimism</a> <a href="https://t.co/g4oiP5akr4" target="_blank">pic.twitter.com/g4oiP5akr4</a></p>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1790582472943821116?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">May 15, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="tornado-cash-in-crypto-crime">Tornado Cash in Crypto Crime</h2> 
<p>Tornado Cash is an open-source cryptocurrency tumbler, also known as a “crypto mixer.” This tool obscures the path of crypto transactions, making it extremely difficult to determine the original source of the funds. Although created as a privacy tool, hackers often use these mixing services to launder stolen funds via decentralized exchange platforms.</p> 
<p>Crypto mixers have seen significant adoption in recent years. In October 2023, over $77 million in assets were processed through Tornado Cash contracts. However, the majority of this <a href="https://btc-pulse.com/tether-expands-in-uae-partners-dao-boost-adoption/">adoption </a>has been with illicit assets. Over the years, hackers have chosen crypto-mixing services over centralized exchanges as once they are identified, addresses are blocked by exchanges. Tornado Cash bypasses this, as a way to legitimize their source of funds by removing connections to a hacked wallet or illicit crypto activity.</p> 
<p>Recently, the United Nations sanctions monitors noted that North Korea was involved in laundering $147.5 million in stolen cryptocurrency using Tornado Cash. Almost all the top multi-million dollar crypto hacks have utilized Tornado Cash to launder the proceeds, as per an Arkham Intelligence report. This prompted the US Treasury to impose sanctions on Tornado Cash in August 2022. As a result, its founders were charged with money laundering and sanctions violations a year later.</p> 
<p>While opinions within the crypto community vary regarding the adoption of privacy tools, there is a consensus against the persecution of developers solely for creating an application. Although crypto-related frauds and scams are on the decline, it is important that users are educated on how to protect themselves from crypto crime.</p>

Sonne Finance Suffers $20M Exploit, Hacker Flees

Table of Contents

BTC-Pulse

Other articles published on May 15, 2024

4 Meme Coin Presales To Buy In May 2024

Cryptocurrency Investment Firm Became the Victim of a Hacker Attack! A Significant Part of the He...

Crypto Tokens Surge in Popularity

Crypto Investor Turns $3,000 into $46 Million with Pepe Trade

Investor Misses Out on Potential Million-Dollar Dogecoin Profit

Borpa: The buzz is growing around the memecoin, get ready for an epic crypto adventure!

Join our free newsletter for daily crypto updates!