DeFi

ALEX Lab

Sonne Finance

Tornado Cash

USDC

<div class="finbold"> 
 <p class="paragraph">In a series of alarming incidents, two prominent decentralized finance (DeFi) platforms, Sonne Finance, and ALEX Lab, have been targeted by sophisticated hacks, resulting in a combined loss of $24.3 million in cryptocurrencies.</p> 
 <p class="paragraph">Sonne Finance halted operations after a $20 million exploit, while ALEX Lab lost $4.3 million due to a suspected private key compromise. Both platforms are now in a race to recover their stolen assets and prevent future breaches.</p> 
 <h2 class="wp-block-heading" id="h-sonne-finance-20-million-heist">Sonne Finance: $20 million heist</h2> 
 <p class="paragraph">Lending <a rel="dofollow" title="protocol" href="https://thebittimes.com/tag/protocol.html">protocol</a> Sonne Finance was forced to pause operations after suffering a hack that drained $20 million worth of cryptocurrencies from the market.&nbsp;</p> 
 <div class="border border-red-300 rounded-xl p-6 not-prose mb-6"> 
  <h3 class="text-2xl font-black mt-0 flex gap-x-3 mb-5"> 
   <svg width="32" height="32" viewbox="0 0 32 32" fill="none" xmlns="//www.w3.org/2000/svg"> <path d="M4 10.6665V25.3332C4 28.2678 6.392 29.3332 8 29.3332H28V26.6665H8.016C7.4 26.6505 6.66667 26.4078 6.66667 25.3332C6.66667 24.2585 7.4 24.0158 8.016 23.9998H28V5.33317C28 3.8625 26.804 2.6665 25.3333 2.6665H8C6.392 2.6665 4 3.73184 4 6.6665V10.6665ZM8 5.33317H25.3333V21.3332H6.66667V6.6665C6.66667 5.59184 7.4 5.34917 8 5.33317Z" fill="#EF4444"> 
    </path> <path d="M15.996 18.6668L20.4626 14.2815C20.738 14.0166 20.9571 13.6989 21.1068 13.3473C21.2564 12.9957 21.3336 12.6176 21.3336 12.2355C21.3336 11.8534 21.2564 11.4752 21.1068 11.1236C20.9571 10.7721 20.738 10.4543 20.4626 10.1895C19.9074 9.64148 19.1587 9.33422 18.3786 9.33422C17.5985 9.33422 16.8498 9.64148 16.2946 10.1895L15.996 10.4801L15.6973 10.1881C15.1423 9.64023 14.3938 9.33301 13.614 9.33301C12.8341 9.33301 12.0856 9.64023 11.5306 10.1881C11.2552 10.453 11.0361 10.7707 10.8865 11.1223C10.7368 11.4739 10.6597 11.852 10.6597 12.2341C10.6597 12.6162 10.7368 12.9944 10.8865 13.346C11.0361 13.6975 11.2552 14.0153 11.5306 14.2801L15.996 18.6668Z" fill="#EF4444"> 
    </path> 
   </svg> Picks for you </h3> 
  <div class="grid md:grid-cols-2 gap-x-10 gap-y-3 md:gap-y-5 divide-y divide-gray-300 md:divide-y-0"> 
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
     From tech to fashion: Who are the top 10 youngest female billionaires in the world <span class="self-center text-xs text-slate-500">17 mins ago</span> 
   </div> 
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
     2 no-brainer Robert Kiyosaki assets to buy right now <span class="self-center text-xs text-slate-500">42 mins ago</span> 
   </div> 
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
     Crypto expert Michaël van de Poppe sells all his Bitcoin; Here’s why <span class="self-center text-xs text-slate-500">2 hours ago</span> 
   </div> 
   <div class="md:odd:pr-4 md:odd:border-r odd:border-gray-300 pt-3 first:pt-0 md:pt-0">
     We asked ChatGPT-4o to make a $1,000 crypto portfolio <span class="self-center text-xs text-slate-500">3 hours ago</span> 
   </div> 
  </div> 
 </div> 
 <div class="mb-4 bg-slate-50 rounded-md layout-adjustment"> 
  <div id="finbold.com_middle" style="min-width: 300px; min-height: 250px;"> 
  </div> 
 </div> 
 <p class="paragraph">The attack, which targeted Sonne Finance’s USD Coin (USDC) and Wrapped Ether (WETH) contracts, was detected on May 14 by Web3 security firm<em> Cyvers</em>.</p> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper"> 
   <blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
    <p lang="en" dir="ltr">ALERTWe have detected an attack on @SonneFinance, $3 million have been stolen from their USDC and WETH contracts.<br> <br>Please contact us for more information. pic.twitter.com/tA4Heigfj7</p>— Cyvers Alerts (@CyversAlerts) May 14, 2024 
   </blockquote> 
  </div>
 </figure> 
 <p class="paragraph">Sonne Finance announced the suspension of all markets on the Optimism (OP) blockchain to mitigate further damage. Partnering with Cyvers, the <a rel="dofollow" title="protocol" href="https://thebittimes.com/tag/protocol.html">protocol</a> is actively investigating the breach and exploring options to recover the stolen funds, including negotiating a bug bounty with the hacker. ‘</p> 
 <p class="paragraph">However, blockchain investigator <em>PeckShield</em> reported that the hacker has already moved a substantial portion of the loot ($7.8 million) to a new wallet address.</p> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper"> 
   <blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
    <p lang="en" dir="ltr">#PeckShieldAlert @SonneFinance exploiter-labeled address has transferred $7.8M worth of cryptos, including 100 $WBTC &amp; 556.1 $ETH, to a new address 0x6277…4c07 #Optimism pic.twitter.com/g4oiP5akr4</p>— PeckShieldAlert (@PeckShieldAlert) May 15, 2024 
   </blockquote> 
  </div>
 </figure> 
 <p class="paragraph">The hacker then swapped 59 Wrapped BTC (WBTC) for roughly 1,185 Ether (ETH) and 183,000 Dai (DAI), indicating an intent to use a privacy <a rel="dofollow" title="protocol" href="https://thebittimes.com/tag/protocol.html">protocol</a> like Tornado Cash to obscure the transaction trail.</p> 
 <h2 class="wp-block-heading" id="details-of-the-exploit">Details of the exploit</h2> 
 <p class="paragraph">According to the incident <a rel="dofollow" title="Category Analysis" href="https://thebittimes.com/analysis.html">Analysis</a> by <em>Certik ,</em>the attack exploited a known bug in Sonne’s Compound v2 forks via a donation attack, manipulating the platform’s exchange rates by donating large amounts of cryptocurrency.&nbsp;</p> 
 <p class="paragraph">This manipulation tricked the system into overestimating its collateral, allowing the hacker to siphon off millions. Blockexplorer data showed the attacker transferred millions of VELO, ETH , USDC following the manipulation, later converting these to $8 million in Bitcoin and Ether.</p> 
 <p class="paragraph">The SONNE token has since plummeted by 60%, drastically reducing its market cap to $20 million, even though developers managed to prevent an additional $6.5 million from being siphoned off once the attack was identified.</p> 
 <h2 class="wp-block-heading" id="alex-lab-4-3-million-compromise">ALEX Lab: $4.3 million compromise</h2> 
 <p class="paragraph">Simultaneously, ALEX Lab, a Bitcoin DeFi tool, was drained of over $4.3 million in various tokens due to a suspected private key compromise. Security researchers from <em>CertiK </em>revealed that the attackers likely obtained a private key controlling ALEX’s XLink bridge, a service facilitating token transfers between different blockchains.</p> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper"> 
   <blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
    <p lang="en" dir="ltr">#CertiKInsight <br><br>We have seen a suspicious transaction affecting @ALEXLabBTC <br><br>Initial evidence points to a possible private key compromise.<br><br>Deployer of 0xb3955302E58FFFdf2da247E999Cd9755f652b13b upgrades to a suspicious implementation.<br><br>In total ~$4.3m worth of assets have… pic.twitter.com/02kiw2dFrm</p>— CertiK Alert (@CertiKAlert) May 14, 2024 
   </blockquote> 
  </div>
 </figure> 
 <p class="paragraph">The breach resulted in the loss of over $300,000 worth of Bitcoin, $3.3 million in stablecoins, and $75,000 in Sugar Kingdom (SKO) tokens. </p> 
 <p class="paragraph">ALEX developers confirmed the hack and claimed they knew the attacker’s identity, offering a 10% bounty for the return of 90% of the stolen funds. Major exchanges have since frozen funds associated with the hacker to prevent further misuse.</p> 
 <p class="paragraph">The recent hacks on Sonne Finance and ALEX Lab highlight the persistent security challenges facing DeFi platforms. </p> 
 <p class="paragraph">As these platforms work to recover stolen assets and enhance their security frameworks, the incidents serve as a stark reminder of the vulnerabilities inherent in the rapidly evolving DeFi landscape.</p> 
 <p class="paragraph"></p> 
</div> 
<p>Source: <a rel="dofollow" target="_blank" href="https://thebittimes.com/major-lending-protocol-hit-by-20m-hack-bitcoin-defi-tool-loses-4-3m-tbt88615.html">https://thebittimes.com/major-lending-protocol-hit-by-20m-hack-bitcoin-defi-tool-loses-4-3m-tbt88615.html</a></p>

Major lending protocol hit by $20M hack; Bitcoin DeFi tool loses $4.3M

Table of Contents

TheBitTimes

Other articles published on May 17, 2024

Bitcoin-Tech Stocks Correlation Hits Peak Level Since August 2023

Solayer Hits $20 Million in Deposits

Bull Market Incoming As Whales Scoops Up 29k ETH Coins While Buying Frenzy Continues At KangaMoon

Five Cryptos to Quadruple Your Investments in May

Solana Surpasses Ethereum and Polygon in Transaction Speed, Reports CoinGecko

Dogecoin Investors Enjoy Recent Price Surge

Join our free newsletter for daily crypto updates!