Onyx

DeFi

Sonne Finance

Optimism

Read

<div class="protos"> 
 Following a relatively quiet period, a trio of crypto hacks has hit the sector. 
 Over the past 24 hours, lending platform Sonne Finance lost $20 million to a well-known attack vector, the bridge to ‘Bitcoin Layer 2’ ALEXLab was drained for $4.3 million, and crypto investment firm BlockTower Capital was found to have been hacked for an undisclosed sum. 
 <h2 class="wp-block-heading" id="sonne-finance-hit-via-empty-market-bug">Sonne Finance hit via ’empty market’ bug</h2> 
 Sonne Finance was hacked on Ethereum L2 Optimism via the ‘empty market’ bug in new markets — in this case, soVELO. 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 The attack is ongoing and much bigger, an additional $17 million has been stolen and the total value loss is more than $20 million. @SonneFinance please take immediate action. https://t.co/k39W09J8Bd— Cyvers Alerts (@CyversAlerts) May 14, 2024
 </blockquote> 
 </div>
 </figure> 
 Read more: Compound Finance upgrade bug freezes $830M in <a rel="dofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> 
 Sonne uses forked code from Compound, one of the first decentralized finance (DeFi) lending protocols. ‘Forking,’ or reusing, code from established projects is a common practice in DeFi, as it’s often considered ‘battle tested’ and therefore safer than freshly written contracts. 
 Compound’s v2 code, however, contains a well-known vulnerability with new, empty markets. This introduces a potential rounding error that can be exploited to drain available borrow liquidity on the platform. Over the past year, the same hack has affected Onyx Protocol, Hundred Finance, and Midas Capital, totaling $10 million in losses. 
 Despite being aware of the issue, Sonne Finance’s post-mortem report explains that the <a rel="dofollow" title="hacker" href="https://thebittimes.com/tag/hacker.html">hacker</a> was able to create the markets “without us noticing,” due to the ‘permissionless’ nature of the functions on Optimism. Sonne’s other deployment, on Base, was not affected. 
 Although $20 million was lost, security researchers were able to save $6.5 million of remaining funds by depositing $100 worth of VELO tokens, making the exploit unworkable. 
 <h2 class="wp-block-heading" id="suspicious-transaction-swipes-4-3m-fom-alexlab-bridge">Suspicious transaction swipes $4.3M fom ALEXLab bridge</h2> 
 Hours before, audit firm Certik identified a ‘suspicious transaction’ in which $4.3 million was removed from the XLink bridge which connects the <a rel="dofollow" title="Bitcoin" href="https://thebittimes.com/tag/bitcoin.html">Bitcoin</a> ‘layer two’ ALEXLab to the BNB Chain. 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 #CertiKInsight We have seen a suspicious transaction affecting @ALEXLabBTC Initial evidence points to a possible private key compromise. Deployer of 0xb3955302E58FFFdf2da247E999Cd9755f652b13b upgrades to a suspicious implementation. In total ~$4.3m worth of assets have… pic.twitter.com/02kiw2dFrm— CertiK Alert (@CertiKAlert) May 14, 2024
 </blockquote> 
 </div>
 </figure> 
 Read more: Refund of $70M ‘address poisoning’ scam ongoing, over 50% returned 
 Styling itself as ‘<a rel="dofollow" title="Bitcoin" href="https://thebittimes.com/tag/bitcoin.html">Bitcoin</a> DeFi,’ ALEXLab is a scaling solution for the <a rel="dofollow" title="Bitcoin" href="https://thebittimes.com/tag/bitcoin.html">Bitcoin</a> network, which itself doesn’t support the smart contracts necessary for DeFi applications to run. 
 Certik states that the losses could be down to ‘a possible private key compromise,’ in which the deployer’s address was unexpectedly upgraded. The ALEXLab team claims to have identified the individual responsible and is proposing a 10% bounty for the return of funds. 
 <h2 class="wp-block-heading" id="h-blocktower-main-hedge-fund-hacked">BlockTower&nbsp;‘main hedge fund’ hacked</h2> 
 <a rel="dofollow" title="Crypto" href="https://thebittimes.com/tag/crypto.html">Crypto</a> investment firm BlockTower Capital was targeted by a hack on its ‘main hedge fund’ according to a Bloomberg report, published on Wednesday. 
 According to the article, BlockTower’s fund was partially drained for an undisclosed sum, citing “people familiar with the matter, who declined to be identified discussing sensitive information.” 
 The firm also lost $1.5 million when DeFi platform Dexible was hacked last year. Responding to the incident at the time, Dexible stated “these things happen.” 
 As the last 24 hours shows, they’re not wrong. 
 Got a tip? Send us an email or ProtonMail. For more informed news, follow us on&nbsp;X,&nbsp;Bluesky, and&nbsp;Google News, or subscribe to our&nbsp;YouTube&nbsp;channel. 
</div>
Source: <a rel="dofollow" target="_blank" href="https://thebittimes.com/at-least-25m-lost-across-three-incidents-in-busy-day-for-crypto-hackers-tbt88444.html">https://thebittimes.com/at-least-25m-lost-across-three-incidents-in-busy-day-for-crypto-hackers-tbt88444.html</a>

At least $25M lost across three incidents in busy day for crypto hackers

Table of Contents

TheBitTimes

Other articles published on May 15, 2024

Top Underrated Cryptos with a 99X Growth Potential

State Of Wisconsin Invests $164 Million In Spot Bitcoin ETFs As ”Big Fish Institutions” Endorse BTC

Bitfarms Doubles Power Capacity in Paraguay, Eyes Sustainable Expansion

Bitget Presents KCGI 2024: The Ultimate Crypto Trading Tournament with a Prize Pool of Ferrari, M...

Cardano Skyrockets $500 Million in Market Cap as ADA Price Shines Green

Bitcoin’s $70k Target: How Soon can BTC Return to Historic Highs?

Join our free newsletter for daily crypto updates!