Discover and read the best of Twitter Threads about #CommunityAlert
Most recents (7)
#CommunityAlert 🚨
@ElephantStatus's Treasury contract experienced a #flashloan attack leading to a loss of around $11M. The Treasury contract is unverified and unaudited.
bscscan.com/address/0xd520…
@ElephantStatus's Treasury contract experienced a #flashloan attack leading to a loss of around $11M. The Treasury contract is unverified and unaudited.
bscscan.com/address/0xd520…
The attacker took advantage of the redeem mechanism of the $TRUNK token, manipulated the price oracle to empower the token return, and stole ELEPHANT from the unverified Treasury contract.
Attack Steps 👇
Attack Steps 👇
1. The attacker deployed an attacker contract and borrowed $WBNB and $BUSD using flashloan from multiple pair pools.
2. Most of the borrowed WBNB was swapped for ELEPHANT to raise the price of ELEPHANT.
2. Most of the borrowed WBNB was swapped for ELEPHANT to raise the price of ELEPHANT.
#CommunityAlert 🚨
At 12:13:14 PM UTC, an attacker claimed a large amount of #APECOIN in the airdrop event by flashloan using $BYAC tokens to redeem for #BAYC NFTs.
The total profit of the attack is around ~ $820K (293 #ETH)
At 12:13:14 PM UTC, an attacker claimed a large amount of #APECOIN in the airdrop event by flashloan using $BYAC tokens to redeem for #BAYC NFTs.
The total profit of the attack is around ~ $820K (293 #ETH)
Incident Analysis
1. The attacker bought NFT No.1060 from OpenSea, which was later used as the flash loan fee to flash loan 5.2 BAYC tokens from the "NFTX Vault"
2. Then used the BAYC tokens borrowed in step 1 to redeem BAYC NFTs (NFT token ID: 7594, 8214, 9915, 8167, 4755)
1. The attacker bought NFT No.1060 from OpenSea, which was later used as the flash loan fee to flash loan 5.2 BAYC tokens from the "NFTX Vault"
2. Then used the BAYC tokens borrowed in step 1 to redeem BAYC NFTs (NFT token ID: 7594, 8214, 9915, 8167, 4755)
3. Then claimed 60,564 ApeCoin tokens as a reward in the Airdrop contract and sold the majority of $APE on the market to #ETH.
4. Minted BAYC NFTs to BAYC tokens to pay back the flash loan and fees.
4. Minted BAYC NFTs to BAYC tokens to pay back the flash loan and fees.
#CommunityAlert 🚨
At 11:20:44 PM +UTC, around 379 #BNB (~$150K) was rugpulled by the $Elona deployer.
The deployer removed the liquidity and transferred 540 #BNB in total to Tornado Cash.
At 11:20:44 PM +UTC, around 379 #BNB (~$150K) was rugpulled by the $Elona deployer.
The deployer removed the liquidity and transferred 540 #BNB in total to Tornado Cash.
Steps:
Elona Deployer minted 1 trillion $Elona tokens:
bscscan.com/tx/0x9c6ccc909…
Deployer burned 500 billion tokens and added the other 500 billion as liquidity, along with 196.5 BNB: bscscan.com/tx/0x7d33e841e…
Elona Deployer minted 1 trillion $Elona tokens:
bscscan.com/tx/0x9c6ccc909…
Deployer burned 500 billion tokens and added the other 500 billion as liquidity, along with 196.5 BNB: bscscan.com/tx/0x7d33e841e…
The deployer removed all the liquidity and got around 260,891,540,144.73 Elona and 379.38 BNB: bscscan.com/tx/0xa27da3c3f…
Deployer transferred all the BNB (382.83) to address 0xbff2d5d4e5a4a7b1859ac5edb010fdafe4ea92a8: bscscan.com/tx/0x54d0358e0…
Deployer transferred all the BNB (382.83) to address 0xbff2d5d4e5a4a7b1859ac5edb010fdafe4ea92a8: bscscan.com/tx/0x54d0358e0…
#CommunityAlert 🚨
@FlurryFi’s Vault contracts were attacked leading to around $293K worth of assets being stolen from Vault contracts
Incident Analysis 👇
@FlurryFi’s Vault contracts were attacked leading to around $293K worth of assets being stolen from Vault contracts
Incident Analysis 👇
The attacker deployed a malicious token contract, which is also used as the attack contract, and created a PancakeSwap pair for the token and $BUSD.
Attacker: bscscan.com/address/0x0f3c…
Malicious token contract: bscscan.com/address/0xb7a7…
PancakeSwap pair: bscscan.com/address/0xca95…
Attacker: bscscan.com/address/0x0f3c…
Malicious token contract: bscscan.com/address/0xb7a7…
PancakeSwap pair: bscscan.com/address/0xca95…
The attacker flashloaned from Rabbit Bank contract and triggered StrategyLiquidate's execute method.
The execute method decodes input data as the LP token address, the attacker is able to execute code implemented in the malicious token contract.
The execute method decodes input data as the LP token address, the attacker is able to execute code implemented in the malicious token contract.
#CommunityAlert🚨
@Meter_IO's Bridge, Meter Passport, has been exploited
Please be cautious if interacting! $MTRG
More info/Analysis coming soon
@Meter_IO's Bridge, Meter Passport, has been exploited
Please be cautious if interacting! $MTRG
More info/Analysis coming soon
#IncidentAnalysis
1. The attacker address:
etherscan.io/address/0x8d3d…
$4.3M in funds were moved to Tornado Cash including 1400 ETH (~$4.2M) and 2 WBTC (~$83k)
One of the exploited tx’s👇
bscscan.com/tx/0xc4d7e160c…
1. The attacker address:
etherscan.io/address/0x8d3d…
$4.3M in funds were moved to Tornado Cash including 1400 ETH (~$4.2M) and 2 WBTC (~$83k)
One of the exploited tx’s👇
bscscan.com/tx/0xc4d7e160c…
The attacker called the `Bridge.deposit()` function to deposit 0.008 BNB to the contract `Bridge` connected to multiple chains including #BSC, #Ethereum, #Moonriver (twice).
#CommunityAlert 🚨
@QubitFin's bridge contract, QBridge, has experience an exploit and minted 77,162 $qXETH worth $80M
QBridge contract on #ETH 👇
etherscan.io/address/0x9930…
Use caution if interacting!
Incident Analysis coming soon
@QubitFin's bridge contract, QBridge, has experience an exploit and minted 77,162 $qXETH worth $80M
QBridge contract on #ETH 👇
etherscan.io/address/0x9930…
Use caution if interacting!
Incident Analysis coming soon
#CommunityAlert 🚨
#Arbix Finance has been identified as #rugpull. Privileged functionalities appear in the identified smart contracts.
The team is looking into it.
DO NOT interact with the project!
#Arbix Finance has been identified as #rugpull. Privileged functionalities appear in the identified smart contracts.
The team is looking into it.
DO NOT interact with the project!
Incident Analysis👇
1. $ARBX contract has mint() with onlyOwner function
2. 10M $ARBX were minted to 8 addresses
3. ~4.5M ARBX were minted to: 0x161262d172699cf0a5e09b6cdfa5fee7f32c183d
4. The 4.5M ARBX were then dumped
1. $ARBX contract has mint() with onlyOwner function
2. 10M $ARBX were minted to 8 addresses
3. ~4.5M ARBX were minted to: 0x161262d172699cf0a5e09b6cdfa5fee7f32c183d
4. The 4.5M ARBX were then dumped
The funds deposited by users ($10M) were directed to unverified pools via the depositor contract
The hacker drained all assets from the pools
Depositor address: tinyurl.com/2p983z9d
1 of the unverified pools: tinyurl.com/yp4dj38v
Hacker address: tinyurl.com/4x98ef26
The hacker drained all assets from the pools
Depositor address: tinyurl.com/2p983z9d
1 of the unverified pools: tinyurl.com/yp4dj38v
Hacker address: tinyurl.com/4x98ef26
