Internet Money

Bank

Magic Internet Money

DeFi

Crypto-Sec is Cointelegraph’s bi-weekly round-up of crypto and cybersecurity stories and tips.
<h2 id="strong-polter-finance-drained-in-classic-flash-loan-attack-strong">Polter Finance drained in “classic” flash loan attack</h2>
Fantom-based decentralized finance (DeFi) protocol Polter Finance was drained of over $7 million through a “classic” flash loan attack on Nov. 18, according to blockchain analyst Nick Franklin.
The attacker artificially increased the price of the SpookySwap governance token, BOO, by borrowing “almost all BOO tokens from&nbsp;LP [the liquidity pool].” Once the price was sufficiently high, the attacker “was able to deposit 1 BOO and drain all pools.”
<figure><img alt="Polter hit by flash loan attack, man gets 24 years for scam: Crypto-Sec" src="https://s3.cointelegraph.com/uploads/2024-11/01933f49-5b59-7a32-8d90-25d16a8ee9d4" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/0xNickLFranklin/status/1858402633935126969" rel="noopener noreferrer nofollow" target="null" text="null" title="https://x.com/0xNickLFranklin/status/1858402633935126969">Nick Franklin</a>
 </figcaption>
</figure>
Data from blockchain analytics platform BlockSec Phalcon confirms that before the attack, there were only 269,042.22851562786 tokens in the liquidity pool.
The attacker then <a data-ct-non-breakable="null" href="https://app.blocksec.com/explorer/tx/fantom/0x5118df23e81603a64c7676dd6b6e4f76a57e4267e67507d34b0b26dd9ee10eac?line=2" rel="noopener noreferrer nofollow" target="null" text="null" title="null">borrowed</a> 269,042.22851562785 BOO tokens ($1.3 million based on the BOO price at the time) through a flash loan, leaving only 0.000000000001 tokens remaining.
Since the price of a token in a decentralized exchange is determined by the ratio between it and the token it is priced in, this must have caused the price of BOO to skyrocket.&nbsp;
The attacker then deposited a single BOO token and proceeded to borrow $9.1 million worth of wrapped Fantom (<a data-ct-non-breakable="null" href="https://cointelegraph.com/fantom-ftm-price-index" rel="noopener noreferrer nofollow" target="_self" text="null" title="https://cointelegraph.com/fantom-ftm-price-index">FTM</a>) tokens, profiting $7.8 million in the process.
The attacker then repeated the attack to gain other tokens, including Magic Internet Money (MIM), sFTMX, Axelar USDC (axlUSDC), Bitcoin (<a data-ct-non-breakable="null" href="https://cointelegraph.com/bitcoin-price" rel="noopener noreferrer nofollow" target="null" text="null" title="null">BTC</a>), Ether (<a data-ct-non-breakable="null" href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow" target="null" text="null" title="null">ETH</a>), and USD Coin (<a data-ct-non-breakable="null" href="https://cointelegraph.com/usdc-price-index" rel="noopener noreferrer nofollow" target="null" text="null" title="null">USDC</a>). Some estimates have claimed that the attack drained a total of $12 million.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/polter-finance-12m-hack-response" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Crypto lender Polter Finance halts operations after $12M hack</a>
Franklin did not speculate on how the attacker was able to regain enough BOO to pay back the flash loan. However, one likely explanation is that they purchased it from a different liquidity pool at a much lower price.
DeFi users should consider the risks of depositing to platforms that carry low liquidity tokens, as the prices of these tokens can often easily be manipulated.
The pseudonymous founder of Polter Finance, known as Whichghost, has filed a police report regarding the incident and is attempting to negotiate with the attacker.
<h2 id="coinpoker-hit-with-hot-wallet-hack">CoinPoker hit with hot wallet hack</h2>
Crypto poker platform CoiPoker was recently the victim of a private key hack, according to a Nov. 18 report from blockchain analytics platform Cyvers. The attacker <a data-ct-non-breakable="null" href="https://x.com/CyversAlerts/status/1858455889029550545" rel="noopener noreferrer nofollow" target="null" text="null" title="null">made</a> transfers across several different networks, including BNB Smart Chain, Ethereum and Polygon.
On Nov. 16, the poker platform <a data-ct-non-breakable="null" href="https://etherscan.io/tx/0x9c40a0fbbeef9e0da5cbc31bf99bd971fa8a51d5db716060a36979fcca3e2344" rel="noopener noreferrer nofollow" target="null" text="null" title="null">attempted</a> to open negotiations with the attacker by posting a message to the Ethereum network.
“We are aware of the activity involving funds stolen from the wallet address [beginning with 0x3c17],” the message stated. “We seek to establish secure communication to address this matter constructively. [ …] We are willing to discuss terms, including a potential bounty, for the safe return of the funds.”
Blockchain data shows the attacker has already <a data-ct-non-breakable="null" href="https://etherscan.io/address/0x4c1e439ec6c73684e2c687d8d57b117383ea95b9" rel="noopener noreferrer nofollow" target="null" text="null" title="null">deposited</a> most of the stolen funds to privacy mixer Tornado Cash, making it difficult to trace, which may create weakness in the platform’s negotiating position.
<figure><img alt="Uniswap, DEX, Fantom" src="https://s3.cointelegraph.com/uploads/2024-11/01933fbe-1452-7ced-b73b-ddc5ce25e37e" title="">
 <figcaption style="text-align: center;">
 Coinpoker attacker launders funds through tornado cash: Source: Etherscan
 </figcaption>
</figure>
Web3 users should be aware that they can lose funds if a centralized gaming platform is hacked and loses customers’ deposits. Luckily, CoinPoker appears to have been resilient in the face of this particular attack, as withdrawals appear to be functioning normally at present.
<h2 id="man-gets-24-years-for-bank-crashing-crypto-scam">Man gets 24 years for bank-crashing crypto scam</h2>
A man from the United States city of Elkhart, Kansas <a data-ct-non-breakable="null" href="https://www.theregister.com/2024/11/05/fbi_pig_kansas_cryptocurrency/" rel="noopener noreferrer nofollow" target="null" text="null" title="null">received</a> a 24-year prison sentence for his role in a crypto scam that crashed the Heartland Tri-State Bank, according to a Nov. 5 report from United Kingdom technology news site The Register. The leader behind the scam has still not been apprehended by authorities.
According to the report, 53-year-old Shan Hanes was the CEO of Heartland Tri-State Bank at the time that he came in contact with a crypto scammer via WhatsApp in 2023.
The scammer reportedly convinced Hanes to invest in a fake cryptocurrency investment scheme. But Hanes didn’t just contribute his own money. He also embezzled funds from the Elkhart Church of Christ and the Santa Fe Investment Club, organizations for which he was in charge of handling the finances.&nbsp;
In addition, Hanes eventually began draining funds from the bank itself. Over $47 million was drained from Heartland Tri-State Bank deposits and sent into this crypto scam, but the scam never turned any real profits, and the money was simply pocketed by its unnamed founder.
The bank’s chief financial officer eventually reported Hanes’ embezzlement to authorities. But by that time, the losses were so large that they were greater than the bank’s capitalization, causing it to go bankrupt.
According to a July 2023 CNN report, the failed bank was first bailed out by the US Federal Deposit Insurance Corporation, then <a data-ct-non-breakable="null" href="https://edition.cnn.com/2023/07/28/business/heartland-tristate-bank-failure/index.html" rel="noopener noreferrer nofollow" target="null" text="null" title="null">purchased</a> by Dream First Bank of Syracuse and reopened.
According to the report, authorities managed to recover $8 million from Hanes’ wallets, but the remaining $39 million was lost forever.
Crypto investors may want to be skeptical of crypto investments that cannot be tracked on a blockchain through a public block explorer. These types of “projects” often turn out to be fictional.

Polter hit by flash loan attack, man gets 24 years for scam: Crypto-Sec

Table of Contents

Cointelegraph

Other articles published on Nov 18, 2024

$180M Satoshi-Era Bitcoin Moved Amid Record Options Expiry: Volatility Ahead?

Base Celebrates Milestone While Addressing Accusations of NFT Misuse

Cryptonica Announces Date for Global Conference in Cape Town, Unveiling Ambitious Plans and Innov...

⁠Floki Surges 17%, As Bonk’s Market Cap Hits $4B, Investors Seen Flocking To Yeti Ouro’s Presale ...

Will XRP Reach $1.50 as Price Rallies 7% Continuing Bull Run?

Whales Push BlockDAG’s Presale to Over $122.5M—As Bitcoin Climbs to 93K and Solana Gains Momentum

Join our free newsletter for daily crypto updates!