Convergence

DeFi

Stake DAO

WazirX

On August 1, the decentralized finance (DeFi) protocol Convergence suffered a devastating breach. The hacker exploited a vulnerability in the protocol’s CvxRewardDistributor smart contract, resulting in the minting and sale of 58 million CVG tokens worth $210,000. Additionally, the attacker siphoned off $2,000 in unclaimed staking rewards. 
According to a recent post-mortem by <a href="https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0" target="_blank" rel="noreferrer noopener nofollow">Wireshark</a>, the hacker’s scheme involved a critical oversight by the Convergence team. An essential line of code was accidentally removed from the smart contract after a series of audits. This omission, intended as a gas optimization, inadvertently allowed the attacker to exploit the contract’s claimMultipleStaking function. 
On August 1 at around 3:00 am UTC, a hacker <a href="https://etherscan.io/tx/0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9" target="_blank" rel="noreferrer noopener nofollow">exploited</a> the CVG token. After minting it, they swiftly converted it into 60 wrapped-Ether and 15,900 Curve.fi FRAX. This led to a near-total collapse of the CVG token’s value, now trading at $0.0004 with a market cap of $57,000. 
<div class="wp-block-image"> 
 <figure class="aligncenter">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXetosWUQtDlpGE9feMGWfAcALRoaYskWGfdgvehGmTj4ywXVvw2EjgESEKN57xEioWSlxBSuX27tKMzppCUDK8LBF-lEEjmoHybUw3ze9_us5Yf3R-HzC7NE2FSbMyi_1aiPYcuUhtbFsNVBFD91IXr9yw?key=I6qILaKiw7fmy_U9L3BBLQ" alt="Peckshield Twitter">
 <figcaption class="wp-element-caption">
 Source: PeckShield
 </figcaption>
 </figure>
</div> 
After bypassing the contract’s validation checks, the hacker used a malicious contract with the same signature as the legitimate claimCvgCvxMultiple function. 
In response, Convergence has assured its community that user funds are safe and urged users to withdraw their assets from the platform. The team acknowledged their mistake and apologized, taking full responsibility for the incident. 
They revealed that while the rewards contract for Stake DAO integration is currently out of commission, no rewards have been lost for its users. Convergence plans to address the issue and communicate future steps soon. 
The hack comes amid a troubling trend in the cryptocurrency space, with July alone witnessing around $266 million in losses due to various exploits. Notably, the Indian trading platform <a href="https://www.cryptotimes.io/2024/07/18/half-of-investors-funds-gone-from-wazirx-in-massive-breach/" target="_blank" rel="noreferrer noopener">WazirX was hit for $230 million</a> on July 18. 
As Convergence works to repair the damage and restore trust, the broader DeFi community remains on high alert, emphasizing the critical importance of robust smart contract security and ongoing vigilance. 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 Also Read: <a href="https://www.cryptotimes.io/2024/07/23/dydx-v3-website-hacked-users-urged-to-stay-away-from-site/" target="_blank" rel="noreferrer noopener">dYdX v3 Website Hacked, Users Urged to Stay Away from Site</a> 
</blockquote>

Hacker Steals $210,000 in CVG Tokens from Convergence

The Crypto Times

Other articles published on Aug 2, 2024

MicroStrategy seeks raising $2b to buy more Bitcoin

Bitcoin Price Drops After Initial Surge

Genesis Transfers $1.5B in BTC and ETH to Likely Repay Creditors

Markets React to Fed’s Rate Decision

HashKey OTC Receives Major Payment Institution License in Singapore

Top Binance Traders Bet on Bitcoin Rebound as 70% Go Long Amid Dip

Join our free newsletter for daily crypto updates!