May 2021 - FinNexus Finished - $7m (Global)
"FinNexus Options makes it easy to buy and exercise BTC, ETH, LINK, SNX, and MKR options in a secure and decentralized way on Ethereum & Wanchain." "The project was initiated by a group of blockchain industry veterans in 2019 with a focus on offering new DeFi products that offer greater diversity, convenience, and value to investors."
"The decentralized options platform reported the incursion on its Twitter feed in the late hours of May 17." "It called it a smart contract hack but industry experts have refuted the claim, suggesting it was a stolen private key for the administrator account."
"According to community feedback and data on the chain, the token FNX of the on-chain option agreement FinNexus has been minted, transferred or sold in a large amount in a short period of time, involving more than 300 million FNX tokens (approximately US$7 million) in BSC and Ethereum , Some users reported that the owner authority of the project contract was previously modified. The FinNexus team stated that it is currently investigating this issue."
"Part of the hardware powering FinNexus has been compromised by malware, in what appears to be a targeted attack on our platform. An unknown hacker infiltrated the FinNexus system and managed to recover the private key to the ownership of the FNX token contract."
"According to the FinNexus team, the ERC-20 smart contract has been hacked." "Others questioned the validity of FinNexus’s hack claims, suggesting that the attack might also have been conducted by one of the project’s disgruntled employees." "[I]ndustry experts believe that the developers themselves could have been the cause of the incident, since someone gained access to the administrator key. The developers have already urged users to withdraw funds from the pools."
"“We regret to inform our traders and investors that the FinNexus erc20 contract appears to have been hacked. For security reasons, withdraw your funds from the pools,” the project’s Twitter page says."
"At the time of this writing, the developers of the protocol did not say what exactly caused the change of address. The developers again called for the withdrawal of cryptocurrency from all pools, as well as to avoid buying FNX on exchanges."
"As soon as the attack took place we notified the exchanges we operate on to stop trading FNX, while our developers performed checks across the board on our contracts to make sure they were not compromised. Rest assured that the private keys to the owner of other FinNexus contracts are safe and no code flaw has been exploited."
"We are currently in contact with centralized exchanges as well as with our partners at Wanchain — the cross-chain portal — to mitigate adverse effects on our users and trace the hacked funds, in a concerted effort to freeze them."
"A new statement with relevant details will be forthcoming soon, covering all the information about the relaunch of the token and the FinNexus protocol."
"[T]une in for an AMA with our co-founders @BorisYangFNX and @rainiefield. All your questions about the hack, the compensation, and FinNexus' relaunch plan answered!"
"As part of a wider effort to rebrand and bring new products to our users, FinNexus is about to change its name."
"We thank all our users and community members, investors and traders for their support and trust at this peculiar time."
Further Analysis
The FinNexus smart contract was fully audited, and most reports suggest that this was the breach of a key which allows for management of the smart contract.
For some reason, the team decided that they would have only one key, and share it amongst themselves. The official story is that malware has gotten onto one of the computers, allowing a hacker to make off with the funds.
In response the platform plans to rename itself, and offer some form of compensation for affected users, however it is not clear what the compensation will be.
How Could This Have Been Prevented?
It should seem very obvious in hindsight that multi-signature is critical to prevent cases where one team member steals the funds and to hugely reduce the risk of breach. Keys should be stored offline and all operators should be trained on their proper use.
More Cryptocurrency Exchange Hacks/Scams/Frauds
Venus Finance Liquidity Failure > > < < BEarnFi BVaults Exploited
Sources/Further Reading
SlowMist Hacked - SlowMist Zone (May 18)
Another Day Another DeFi Hack: FinNexus Protocol Exploited for $7.6M (May 19)
FinNexus Homepage (May 24)
About FinNexus (May 24)
@fin_nexus Twitter (May 24)
@fin_nexus Twitter (May 24)
A New Start Finnexus Compensation And Security Enhancement Plan (May 24)
Finnexus Statement Regarding The May 2021 Hack (May 24)
Ethereum Transaction Hash (Txhash) Details | Etherscan (May 24)
FinNexus Whitepaper (May 24)
Latest DeFi Hack Drains $7.6M From FinNexus Options Protocol (May 24)
@fin_nexus Twitter (May 24)
@fin_nexus Twitter (May 24)
@FrankResearcher Twitter (May 24)
What is FinNexus? | Genesis Block (May 24)
DeFi tool FinNexus (FNX) plunges by 90% after hack—some allege an inside job (May 24)
FinNexus Contract Deployer Exploited, Sending Token in a -90% Spiral (May 24)
Pdfs/PeckShield-Audit-FinnexusOptionsV1.0.pdf at master · FinNexus/Pdfs · GitHub (May 24)
A New Start Finnexus Compensation And Security Enhancement Plan (Jun 26)
CertiK Blockchain Security Leaderboard (Jun 1)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|