Recently, hackers found a vulnerability in Multichain’s code, a so-called cross-chain bridge. From bug was found last Monday and hackers had stolen about $1.43 million worth of various crypto as ethereum (ETH), wrapped ether (WETH), wrapped binance coin (WBNB), avalanche (AVAX), polygon (MATIC), peri finance (PERI) en mars token (OMT).
However, it didn’t stop there. The Multichain team was unable to immediately solve the problem, so that several hackers continued to abuse the error in the following days. In the end, as much as $3 million worth of crypto was stolen from the platform.
Multichain, formerly Anyswap, received a lot of criticism for this. The makers of the platform are said to have been unclear about what exactly was going on and did not offer victims enough support. A user lost a whopping $960,000 worth of crypto.
Hacker returns part and keeps part
However, the story now has a slightly more positive tail. One of the hackers returned 322 ETH, currently worth about $900,000, to the protocol and to one of the victims. The value of this ETH is now slightly lower due to today’s plunging prices.
📢Update
According to the tracking data, one whitehat hacker has returned 259 ETH (https://t.co/BvTwOQTsE1). At this moment, a total of 602.693538 ETH is exploited. We are trying to get more funds back.— Multichain (Previously Anyswap) (@MultichainOrg) January 20, 2022
However, the hacker has also decided to keep some of it for himself, labeling it a “bug bounty,” or a reward for finding the bug. However, that means that some 528 ETH worth almost $1.5 million has not yet been returned.
The flaw still exists, by the way, but Multichain has taken $44.5 million from the various contracts to protect the money. Meanwhile, the CEO of Multichain indicates that the “bridge contract” lacked a pause function:
Yeah, bridge contract need pause function. https://t.co/lPjLsE5EtR
— Zhaojun (@zhaojun_sh) January 20, 2022
The story is somewhat reminiscent of one of the biggest hacks ever in the crypto world. Last summer, someone stole a whopping $611 million worth of crypto from Poly Network (not to be confused with Polygon) and later sent the crypto back.
Recently, Ethereum founder Vitalik Buterin explained why he thinks these kinds of cross-chain bridges are dangerous. Multichain received $60 million at the end of last year in a funding round led by Binance, the largest cryptocurrency exchange in the world.
–
