Hackers steal $80 mn in cryptocurrency from Qubit, a DeFi lending firm; $250,000 bounty offered

More than $80 million of digital assets were swiped from a decentralized finance platform in the latest hack of cryptocurrency trading marketplaces. A blockchain extension by Qubit Finance, a DeFi lending firm, was exploited by a hacker on Thursday night, according to a company release. The add-on known as X-Bridge allows people to exchange tokens between Ethereum and Binance Smart Chain, two of the most popular blockchains.

The attacker garnered a total of $185 million in xETH, or Xpolsive Ethereum, by using malicious data to extract tokens from the Binance Smart Chain that was never deposited into Ethereum, as the code directs, according to a report by blockchain auditing firm CertiK.

Qubit wrote an open letter to the person responsible offering a bounty of as much as $250,000 and requesting to negotiate the return of lost funds which effect “thousands of real people.” The company has disabled certain functions of the X-Bridge while it investigates the issue.

Cybersecurity breaches have become ubiquitous on cryptocurrency trading platforms, leaving investors frustrated and companies suspending services to fix network vulnerabilities. It is a caveat of a system where transactions can only be traced to anonymous serial codes rather than personal identifications. A record $1.3 billion was stolen in DeFi scams and exploits in 2021.

“As we move from an Ethereum-dominant world to a truly multi-chain world, bridges will only become more important,” Connie Lam, head of incident response at CertiK, said in a note. “People need to move funds from one blockchain to another, but they need to do so in ways that are not susceptible to hackers.”

Qubit did not immediately respond to a request for comment.

Crypto Coin Holders Vote Felon Treasurer Out of DeFi Project

(Bloomberg) Investors in decentralized-finance project Wonderland have voted out a felon who was overseeing the project’s treasury.

Some 87% of Wonderland’s participating token holders voted to oust the project’s treasury head, who goes by the pseudonym Sifu or OxSifu and was unmasked as Michael Patryn, a co-founder of the failed Canadian crypto exchange QuadrigaCX. Wonderland, which lets people earn yield on their digital coin holdings, has a treasury of $670.4 million, per its website.

Wonderland co-founder Danielle Sestagalli asked Patryn to step down Thursday. The project’s material treasury activity was suspended until the outcome of the vote, which ran for two days.

Patryn, who also formerly went by Omar Dhanani before legally changing his name on two occasions, spent 18 months in U.S. federal prison and was deported to Canada after pleading guilty to conspiracy to commit credit-and-bank-card fraud in 2005, and burglary, grand larceny and computer fraud two years later.

He later became affiliated with Quadriga’s co-founder Gerald Cotten in the early days of the Canadian exchange, though the men parted ways in early 2016. Patryn wasn’t accused of any wrongdoing related to Quadriga’s collapse. Quadriga has captivated the crypto world since 2018, when Cotten’s sudden death revealed a massive fraud that caused at least C$169 million ($133 million) in losses for 76,000 investors in Canada and abroad.

Thanks to the anonymity of people involved with most DeFi crypto projects, Patryn’s identity was kept a secret until it was outed by an anonymous Twitter user. Sestagalli said he found out about Patryn’s identity a month ago, but hadn’t changed tack until recently, as he believed in giving second chances.

In a statement published on Wonderland’s forum Friday, Sestagalli said that while some users said Wonderland should now be wound down, “this is the easy way out.” Instead, he suggested hiring professionals to manage the project’s treasury, conduct regular audits and publish regular financial reports. Wonderland is also preparing for dissolution as an option, he said.

Wonderland’s Time token has slumped more than 65% over the past week, according to crypto tracker CoinMarketCap.