Macauley Peterson

<div id="highlights-block_61a8b2da5d660" class="highlights">
        <ul>
                <li>BadgerDAO smart contracts remain paused following website exploit that cost users $120 million, as community pursues investigation and reaches out to the thief in hopes of striking a deal</li>
                <li>BitMart Exchange suffered an even larger loss after two hot wallet private keys were compromised</li>
            </ul>
    
</div>



<p>A bitcoin-focused DeFi protocol, BadgerDAO, had its web server compromised for roughly two weeks, allowing an unknown attacker to surreptitiously steal millions of dollars worth of digital assets from users of the platform, <a href="https://cms.blockworks.co/hackers-drain-115-million-from-bitcoin-defi-focused-badgerdao/" target="_blank" rel="noreferrer noopener">Blockworks reported</a>.</p>



<p>On Sunday, representatives of the DAO attempted to contact the party responsible for the theft using a message <a href="https://etherscan.io/tx/0xe0bf600d62e99f2f7b0bd6ce27a7167b8c04bd5a06727155c0334ca5c39dfd6c" target="_blank" rel="noreferrer noopener">published in a transaction on the Ethereum</a> network and on Twitter:</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">To the Actor<br>You&#39;ve taken funds that don&#39;t belong to you but we&#39;re willing to work with &amp; compensate you for identifying this vulnerability in the systems. <br><br>We&#39;re providing you with a direct line of communication to discuss a peaceful resolution without involving outside parties</p>&mdash; ₿adgerDAO 🦡 (@BadgerDAO) <a href="https://twitter.com/BadgerDAO/status/1467333920089858048?ref_src=twsrc%5Etfw">December 5, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>According to <a href="https://badger.com/exploit/updates" target="_blank" rel="noreferrer noopener">a website set up to provide updates</a> on the case, the group has enlisted blockchain forensic analysis platform <a href="https://www.chainalysis.com/" target="_blank" rel="noreferrer noopener">Chainalysis</a> and cybersecity firm <a href="https://www.mandiant.com/" target="_blank" rel="noreferrer noopener">Mandiant</a>, to help with the investigation. The latest update said that BadgerDAO&#8217;s DeFi services remain temporarily shut down:</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p><strong>&#8220;Smart Contracts have not yet been reactivated and therefore users remain unable to deposit, claim rewards, or withdraw from either the Badger app (app.badger.com) or at the smart contract level. Badger is working to ensure that the smart contracts can be safely reactivated without further risk to funds.&#8221;</strong></p></blockquote>



<p>The system has a &#8220;Guardian&#8221; role, that has permission to pause the DeFi strategies employed by the protocol, which is &#8220;intended to be a trusted party that can act fast in emergency situations,&#8221; according to the <a href="https://docs.badger.com/badger-finance/technical/setts/base#variables" target="_blank" rel="noreferrer noopener">Badger.com documentation</a>. The Guardian is controlled by a developer multi-signature wallet, whose five members are elected by the DAO&#8217;s BADGER token holders. Any single member of the multisig can pause the smart contracts, but it requires three out of the five signers to reactivate them.</p>



<p>Security company PeckShield <a href="https://twitter.com/peckshield/status/1466356911842856967" target="_blank" rel="noreferrer noopener">reports the total loss</a> to BadgerDAO&#8217;s users at $120.3 million, based primarily on the theft of 2,100 BTC and 151 ETH. The largest affected user of the protocol <a href="https://cms.blockworks.co/celsius-reportedly-affected-in-exploit-of-defi-protocol-badgerdao/" target="_blank" rel="noreferrer noopener">has been linked</a> to cryptocurrency lending platform Celsius.</p>



<h3 class="wp-block-heading">BitMart Exchange loses $200 million in breach</h3>



<p>Sheldon Xia, founder and CEO of the centralized exchange BitMart.com, revealed on Sunday that two of the exchange&#8217;s hot wallets were compromised in a security breach that saw upwards of $150 million in assets disappear on the Ethereum and Binance Smart Chain networks.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">1/3 We have identified a large-scale security breach related to one of our ETH hot wallets and one of our BSC hot wallets. At this moment we are still concluding the possible methods used. The hackers were able to withdraw assets of the value of approximately USD 150 millions.</p>&mdash; Sheldon Xia (@sheldonbitmart) <a href="https://twitter.com/sheldonbitmart/status/1467316252855226368?ref_src=twsrc%5Etfw">December 5, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Xia said that an exchange private key was used to withdraw the funds, and <a href="https://twitter.com/sheldonbitmart/status/1467722582845702149" target="_blank" rel="noreferrer noopener">pledged via Twitter</a>, to make users whole.</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p><strong>&#8220;BitMart will use our own funding to cover the incident and compensate affected users. We are also talking to multiple project teams to confirm the most reasonable solutions such as token swaps. No user assets will be harmed.&#8221;</strong></p></blockquote>



<p>PeckShield, which <a href="https://twitter.com/peckshield/status/1467289808045494276?s=20" target="_blank" rel="noreferrer noopener">initially pointed out</a> a pattern of suspicious transactions early Sunday morning, <a href="https://twitter.com/peckshield/status/1467310381073047552" target="_blank" rel="noreferrer noopener">has estimated the loss</a>, comprised of a variety of small cap tokens, as totaling $200 million.</p>



<hr class="wp-block-separator">
<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>
<hr class="wp-block-separator">


BadgerDAO

BadgerDAO Contacts Hacker Seeking Settlement; BitMart Exchange Loses $200M

Liz Coyne

Jacquelyn Melinek

<div id="highlights-block_61a99363c8d9f" class="highlights">
        <ul>
                <li>Hackers stole $115 million from users of the bitcoin-focused Badger DAO on Wednesday</li>
                <li>Like many crypto companies, Celsius is not FDIC insured nor a federally regulated bank</li>
            </ul>
    
</div>



<p>The Wednesday $115 million hack to the bitcoin-focused DeFi protocol BadgerDAO appears to have impacted Celsius Network to the tune of approximately $54 million, according to on-chain data from <a href="https://etherscan.io/tx/0x951babdddbfbbba81bbbb7991a959d9815e80cc5d9418d10e692f41541029869" target="_blank" rel="noreferrer noopener">etherscan</a>.</p>



<p>While the on-chain data does not definitively prove that the funds belonged to the crypto lender, the wallet that was impacted was seeded by a series of wallets that originates with Celsius.</p>



<p>Initial reports showed that a wallet linked to Celsius had 896 wrapped bitcoins stolen.</p>



<p>Celsius’ losses at this time could amount to approximately $54 million USD, a little under one-half of the total amount <a href="https://cms.blockworks.co/hackers-drain-115-million-from-bitcoin-defi-focused-badgerdao/" target="_blank" rel="noreferrer noopener">stolen</a> from BadgerDAO.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">How Celsius lost $50,000,000 today and why wannabe bankers are easy prey to the crypto-savvy. Should investors &amp; users be weary?<br> TLDR: Celsius banked on BadgerDAO, which was just hacked for $120m and it was the biggest loser. 1/x*n</p>&mdash; BigTimeCali | EGLD $2k | BTC ^ (@BigTimeCali) <a href="https://twitter.com/BigTimeCali/status/1466556925127000065?ref_src=twsrc%5Etfw">December 2, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>When Blockworks reached out to Celsius CEO Alex Mashinsky for comment on Thursday evening he said the company would provide a statement on Friday, but did not comment further.</p>



<p>On Friday, Celsius released a <a href="https://twitter.com/celsiusnetwork/status/1466833049014972422?s=21">series of Tweets</a>, addressing the hack. “No Celsius client and user assets were affected,” the company wrote.</p>



<p>BadgerDAO has hired data forensic experts Chainalysis to investigate the hack and is progressing with internal and external investigations, according to a recent tweet.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">The investigation continues. <br><br>Badger has retained data forensics experts Chainalysis to explore the full scale of the incident &amp; authorities in both the US &amp; Canada have been informed &amp; Badger is cooperating fully with external investigations as well as proceeding with its own.</p>&mdash; ₿adgerDAO 🦡 (@BadgerDAO) <a href="https://twitter.com/BadgerDAO/status/1466535158606086144?ref_src=twsrc%5Etfw">December 2, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>“As of right now, we have nothing further to share outside of the recent post. We will continue to provide updates as they come available,” a BadgerDAO admin said to Blockworks Thursday night.</p>



<p>As Blockworks reported early Thursday, the hack on BadgerDAO didn’t appear to be an attack on the protocol itself. Instead, the hackers went after the web interface connecting the protocol to the users’ wallets.&nbsp;</p>



<p>Many BadgerDAO Discord users reported that when their wallets interacted with BadgerDAO, they were hit with requests for additional permissions and then transferred tokens to wallets controlled by the hackers, Blockworks reported.</p>



<p>As with many cryptocurrency companies, neither BadgerDAO nor Celsius are federally regulated banks or FDIC-insured.</p>



<p>It’s been a wild two weeks for Celsius. On Nov. 24, the company <a href="https://cms.blockworks.co/celsius-expands-its-series-b-from-400m-to-oversubscribed-750m/" target="_blank" rel="noreferrer noopener">announced</a> it had expanded its Series B From $400 million to an oversubscribed $750 million. On Nov. 29, the company <a href="https://cms.blockworks.co/celsius-suspends-cfo-due-to-external-fraud-sexual-assault-investigation/" target="_blank" rel="noreferrer noopener">suspended</a> its Chief Financial Officer Yaron Shalem due to external fraud and sexual assault allegations.</p>



<p><em>This story was updated on Friday, Dec. 3, 2021, at 2:01 pm ET, to include the latest comments from Celsius on Twitter.</em></p>



<hr class="wp-block-separator"/>



<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>



<hr class="wp-block-separator"/>


Celsius Reportedly Affected in Exploit of DeFi Protocol BadgerDAO

Sam Reynolds

<div id="highlights-block_61a8b2da5d660" class="highlights">
        <ul>
                <li>BadgerDAO has paused its smart contracts after falling victim to an exploit allowing 2,063.37 BTC and counting to be surreptitiously removed from the protocol</li>
                <li>Initial security audits and members of the DAO’s Discord believe that the exploit came from its web frontend</li>
            </ul>
    
</div>



<p>Another DeFi protocol has fallen victim to an eight-figure hack, as Badger DAO reports that it has noticed “unauthorized withdrawals” from its protocol.&nbsp;</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Badger has received reports of unauthorized withdrawals of user funds.<br><br>As Badger engineers investigate this, all smart contracts have been paused to prevent further withdrawals.<br><br>Our investigation is ongoing and we will release further information as soon as possible.</p>&mdash; ₿adgerDAO 🦡 (@BadgerDAO) <a href="https://twitter.com/BadgerDAO/status/1466263899498377218?ref_src=twsrc%5Etfw">December 2, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>BadgerDAO initially reported that $10 million had been pilfered, though reports from blockchain security and analytics company <a href="https://twitter.com/peckshield/status/1466350031288500227">PeckShield puts that number</a> closer to $115 million, over 2,063 bitcoins. One unlucky user <a href="https://twitter.com/peckshield/status/1466294179676372992" target="_blank" rel="noreferrer noopener">lost 900 bitcoin</a>.&nbsp;</p>



<p>BadgerDAO’s mission, as it describes it, is to “bring Bitcoin to DeFi” by creating various <a href="https://cms.blockworks.co/wrapped-crypto-tokens-and-why-theyre-critical-to-markets/">wrapped bitcoin</a> products. </p>



<p>Unlike many other hacks of DeFi protocols, this one doesn’t appear to be an attack on the protocol itself, but rather the web interface connecting the protocol to the users’ wallets to the protocol.&nbsp;</p>



<p>On <a href="https://discord.com/invite/xSPFHHS" target="_blank" rel="noreferrer noopener">the BadgerDAO Discord</a>, many users complained that when their wallets interacted with BadgerDAO they were hit with requests for additional permissions and then transferred tokens to wallets controlled by the hackers.&nbsp;</p>



<p>“It looks like a bunch of users had approvals set for the exploit address allowing it to operate on their vault funds and that was exploited,” Badger developer Tritium wrote on Discord.&nbsp;</p>



<p>Currently, BadgerDAO has decided to pause all smart contracts to prevent further withdrawals as it investigates further.&nbsp;</p>



<p>BadgerDAO’s governance token BADGER is down sharply on the news.</p>




<div class="tradingview-widget-container">
  <div class="tradingview-widget-container__widget"></div>
  <script type="text/javascript" src="https://s3.tradingview.com/external-embedding/embed-widget-single-quote.js" async="">
  {
  "symbol": "BINANCE:BADGERUSDT",
  "width": "100%",
  "colorTheme": "light",
  "isTransparent": false,
  "locale": "en"
}
  </script>
</div>




<p>The founder of BadgerDAO, Chris Spadafora, who goes by the moniker SpadaBoom (with the &#8216;B&#8217; as a Bitcoin symbol), announced that the smart contracts would remain paused, preventing withdrawals from the protocol.</p>



<p>&#8220;Badger has retained data forensics experts Chainalysis to explore the full scale of the incident and authorities in both the US and Canada have been informed and Badger is cooperating fully with external investigations as well as proceeding with its own,&#8221; Spadaboom wrote on Discord Thursday evening (ET).</p>



<p>Token holders <a href="https://badger.com/governance" target="_blank" rel="noreferrer noopener">are responsible for approving changes</a> to the decentralized protocol on Ethereum, but the <a href="https://badger.com/" target="_blank" rel="noreferrer noopener">Badger.com</a> frontend is separate from the project&#8217;s Ethereum smart contracts, and the core team retains some administrative powers.</p>



<p>According to Badger Core team member Mitche50, commenting on the BadgerDAO Discord&#8217;s &#8220;general&#8221; channel:</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p><strong>“It looks like an API key for cloudflare was compromised. Through this, the hacker was able to create a script, inject the script into custom routes and serve the frontend with the malicious script injected.”</strong></p></blockquote>



<p>Cloudflare is a widely used American website infrastructure company that provides content delivery network and helps sites defend against denial-of-service attacks.</p>



<p>Among the unresolved questions are, how long has this exploit been operative, and why did it go undetected? Mitche50 told Blockworks, “the investigation of exactly what happened is still ongoing.”</p>



<p>It’s also unclear, whether the affected users will be able to be compensated for losses by the DAO, or by insurance protocol Nexus Mutual, which offers insurance on BadgerDAO, currently at a rate of 2.6% annually.</p>



<p>The insurers’ <a href="https://app.nexusmutual.io/cover/buy/get-quote?address=0x6354E79F21B56C11f48bcD7c451BE456D7102A36" target="_blank" rel="noreferrer noopener">term and conditions</a> note that insurance covers only “contract bugs, economic attacks, including oracle failures [and] governance attacks,” and Nexus’ own governance may determine the present exploit is outside the scope of coverage.</p>



<p>The Nexus team issued a statement in <a href="https://discord.gg/aQjkzW5" target="_blank" rel="noreferrer noopener">their Discord&#8217;s</a> &#8220;claims-discussions&#8221; channel indicating that BadgerDAO cover holders may be out of luck in this case:</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p><strong>&#8220;If this is confirmed as a frontend attack, BadgerDAO’s smart contracts were not impacted and this would not be a covered event.</strong></p><p><strong>Frontend attacks are not covered per section 9 of the <a href="https://nexusmutual.io/pages/ProtocolCoverv1.0.pdf" target="_blank" rel="noreferrer noopener">Protocol Cover wording</a>.&#8221;</strong></p></blockquote>



<p>Even if Nexus were to include the hack as a covered event, as of today, less than $14.25 million in coverage was purchased, according to <a href="https://nexustracker.io" target="_blank" rel="noreferrer noopener">nexustracker.io</a>.</p>



<p>BadgerDAO launched its first launched yield-generating vaults based on wrapped bitcoin on Ethereum, in December 2020. The project quickly moved to community-based governance through the distribution of the BADGER token, which has been used to vote on over 70 improvements to the protocol since launch.</p>



<p>BadgerDAO&#8217;s total value locked peaked in February at $2.32 billion, but the protocol still has $1.1 billion in assets, <a href="https://defillama.com/protocol/badger-dao" target="_blank" rel="noreferrer noopener">according to DeFi Llama</a>.</p>



<p>While this hack is significant, it pales in comparison to some of the largest successful exploits that have occurred against DeFi protocols this year. For instancce, in August, hackers made off with nearly <a href="https://cms.blockworks.co/hackers-steal-over-600m-biggest-in-defi-history/" target="_blank" rel="noreferrer noopener">$600 million after they exploited bugs</a> in the Poly Network.</p>



<p><em>This story was updated on December 2, 2021 at 12:10 pm ET with a statement from Nexus Mutual. The headline was updated to clarify that funds were not drained from the BadgerDAO protocol itself, but directly from users of the Badger.com frontend.</em></p>



<p><em>This story was updated on December 3, 2021 at 3:30 AM to include a comment from BadgerDAO founder Chris Spadafora.</em></p>



<hr class="wp-block-separator">
<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>
<hr class="wp-block-separator">

BadgerDAO

Newsletter

Blockworks Research