Arbitrum

Prime

Delta

when

USDC

A hacker managed to drain over $6 million from the decentralized finance (DeFi) protocol Delta Prime by minting an arbitrarily large number of deposit receipt tokens. 
According to data from block explorer Arbiscan, the attacker <a data-ct-non-breakable="null" href="https://arbiscan.io/tx/0x28a9b62fbfc375ebb3f5321d80baac9c2a225a6ec2f140cbfae5bff95fc80b1e" rel="nofollow noopener" target="_blank" text="null" title="https://arbiscan.io/tx/0x28a9b62fbfc375ebb3f5321d80baac9c2a225a6ec2f140cbfae5bff95fc80b1e">minted</a> over 115 duovigintillion Delta Prime USD (DPUSDC) tokens in the initial attack, which is more than 1.1*10^69 in scientific notation.
DPUSDC is a deposit receipt for USDC (<a data-ct-non-breakable="null" href="https://cointelegraph.com/usdc-price-index" rel="" target="_self" text="null" title="https://cointelegraph.com/usdc-price-index">USDC</a>) stablecoin held at Delta Prime. It is intended to be redeemable at a 1:1 ratio for USDC.
Despite minting such a large number of USDC deposit receipts, the attacker only burned 2.4 million of them, receiving $2.4 million USDC stablecoin in exchange.
<figure>
 <img alt="Delta Prime attacker stole $6M by minting massive number of tokens" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191fb14-b6cd-7c86-bab1-0e1c20d53da4">
 <figcaption style="text-align: center;">
 Attacker minting a very large number of DPUSDC tokens and redeeming some of them. Source: Arbiscan.
 </figcaption>
</figure>
The attacker then repeated these steps for other deposit receipt tokens, minting over 1 duovgintillion Delta Prime Wrapped Bitcoin (DPBTCb), 115 octodecillion Delta Prime Wrapped Ether (DPWETH), 115 octodecillion Delta Prime Arbitrum (DPARB), and many other deposit receipt tokens, ultimately redeeming a tiny fraction of the amount minted to receive over $1 million in Bitcoin (<a data-ct-non-breakable="null" href="https://cointelegraph.com/bitcoin-price" rel="" target="_self" text="null" title="https://cointelegraph.com/bitcoin-price">BTC</a>), Ether (<a data-ct-non-breakable="null" href="https://cointelegraph.com/ethereum-price" rel="" target="_self" text="null" title="https://cointelegraph.com/ethereum-price">ETH</a>), Arbitrum (ARB), and other tokens.&nbsp;
According to blockchain security specialist Chaofan Shou, the attacker has stolen an estimated $6 million in funds so far.
 
<figure>
 <img alt="Delta Prime attacker stole $6M by minting massive number of tokens" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191fb0d-8229-792e-bc33-459692c4063a">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/shoucccc/status/1835554652777336975" rel="null" target="null" text="null" title="https://x.com/shoucccc/status/1835554652777336975">Chaofan Shu</a>.
 </figcaption>
</figure>
The attacker was able to mint these deposit receipt tokens by first gaining control of an admin account ending in b1afb, which they likely accomplished by stealing the developer’s private key. Using this account, they <a data-ct-non-breakable="null" href="https://arbiscan.io/tx/0xacea7f1203fa31b1e8aef7f53d91d427f86b4d93a6519c0e967a6c834b1a4849" rel="nofollow noopener" target="_blank" text="null" title="https://arbiscan.io/tx/0xacea7f1203fa31b1e8aef7f53d91d427f86b4d93a6519c0e967a6c834b1a4849">called</a> an “upgrade” function on each of the protocol’s liquidity pool contracts.&nbsp;
These functions are intended to be used for software upgrades. They allow the developer to change the code in a contract by having its proxy point to a different implementation address. 
However, the attacker used these functions to point each proxy to a malicious contract that the attacker had created. Each malicious contract allowed the attacker to mint an arbitrarily large number of deposit receipts, effectively letting them drain each pool of funds.
<figure>
 <img alt="Delta Prime attacker stole $6M by minting massive number of tokens" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191fb0c-56d9-753d-bb01-a598f2a57f89">
 <figcaption style="text-align: center;">
 Delta Prime attacker upgrading contracts. Source: Arbiscan.
 </figcaption>
</figure>
Delta Prime <a data-ct-non-breakable="null" href="https://x.com/DeltaPrimeDefi/status/1835603279369125893" rel="null" target="null" text="null" title="null">acknowledged</a> the attack in an X post, stating that “At 6:14 AM CET DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M.” 
It claimed that the Avalanche version, DeltaPrime Blue, is not vulnerable to the attack. It also stated that the protocol’s insurance “will cover any potential losses where possible/necessary.”
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/delta-prime-defi-hacked-6-m-arbitrum" rel="null" target="null" text="null" title="null">DeFi platform Delta Prime suffers $6M breach</a>
The Delta Prime attack illustrates the risk of DeFi protocols using upgradeable contracts. 
The Web3 ecosystem is designed to prevent private key hacks from exploiting entire protocols.
Theoretically, an attacker should need to steal the private keys of every user to drain the entire protocol. However, when contracts are upgradable, it introduces an element of centralization risk, which can lead to an entire user base losing its funds.&nbsp;
Even so, some protocols believe that giving up the ability to upgrade may be worse than its alternative, as it may prevent a developer from fixing bugs found after deployment. Web3 developers continue to debate when protocols should and should not allow upgrades.
Smart contract exploits continue to pose a risk to Web3 users. On Sept. 11, an attacker <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/attacker-1-4-million-cut-token-pools-unverified-contract" rel="null" target="null" text="null" title="null">drained over $1.4 million</a> from a CUT token liquidity pool using an obscure line of code that pointed to an unverified function on a separate contract. 
On Sept. 3, over $27 million was drained from the Penpie protocol after the attacker successfully <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/pythia-finance-drained-53k-crypto-sec/" rel="null" target="null" text="null" title="null">registered their own malicious contract</a> as a token market.

Delta Prime attacker stole $6M by minting massive number of tokens

Cointelegraph

Other articles published on Sep 16, 2024

FTX/Alameda Wallet Unstakes $24M SOL Amid Ongoing Investigations: Report

61% Ethereum (ETH) Holders in Profit Amid Strong Bearish Pressure

Succinct Labs and OP Labs Team Up to Launch New Zero-Knowledge Proof Solution

Flappy Bird creator disavows revived game that hints crypto ties

Qubetics Pioneers Blockchain Security with Quantum-Resistant Addressing and Whitelist Perks

Whales Buying the Market Dip, Toncoin, Cardano, and Angry Pepe Fork Top the List

Join our free newsletter for daily crypto updates!