Hackers found a flaw in a decentralized crypto exchange and exploited it to steal an estimated $113 million.
On Sunday, the founder and CEO of Maiar—a decentralized exchange (DEX) that bills itself as “the future of money”—and the Elrond blockchain that it runs on, wrote on Twitter that he and his team were “investigating a set of suspicious activities on the Maiar DEX.” As it turned out, the suspicious activities were those of hackers.
Videos by VICE
On Monday, Mincu published a Twitter thread detailing the incident. In the thread, Mincu said “a bug was discovered and exploited,” and that the team was now working on recovery of the DEX and had patched the bug. The developers took the exchange offline shortly after discovering the hack, according to Mincu. The exchange’s website currently says it is in “scheduled” maintenance.
But, at that point, the hackers had already done the damage. According to a blockchain researcher who goes by Foudres, the hacker stole around 1,650,000 EGLD, the native token of the Elrond blockchain, with around $113 million at the time of the hack. The hackers used three wallets to drain funds from the exchange, and were able to sell 800,000 EGLD, which caused the price of EGLD on the Maiar exchange nosedived from $76 to $5, Foudres explained.
Do you have information about other crypto hacks? Do you research vulnerabilities on cryptocurrencies and their networks? We’d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, Wickr/Telegram/Wire @lorenzofb, or email lorenzofb@vice.com
Mincu, claimed in a tweet that “most exploited funds have been either recovered in full, or will be covered by the Elrond Foundation. This means funds are safe, & all funds will be available in full at restart.” Mincu said that swaps on the exchange will restart once its price matches the EGLD price on Binance, which is currently $67.72.
It’s unclear how the Maiar team was able to retrieve the funds, or how exactly the hack occured. Mincu referenced not one, but two “mainnet” upgrades, which typically refers to rolling out a new blockchain version. On Tuesday morning, staking provider Everstake tweeted that it had updated its nodes to a new version of Elrond.
Elrond is an upstart blockchain that launched in 2020, pitching itself as being uniquely scalable. Decentralized exchanges like Maiar are similarly recent innovations and differ from centralized exchanges such as Coinbase because they run on smart contracts, and there is typically no centralized order book to match orders among users, who instead trade using user-provided pools of liquidity with algorithms determining price. However, as previous incidents leading to DEX downtime have shown, certain setups can have critical points of failure as well.
Maiar did not respond to an email requesting comment. Mincu also did not respond to a request for comment sent via Twitter DM.
The hack on Maiar is yet another incident in a seemingly endless series of hacks in the crypto and Web3 worlds. As of early May, hackers and scammers have stolen $1.6 billion in crypto, according to blockchain cybersecurity company CertiK.
Subscribe to our podcast, CYBER. Subscribe to our new Twitch channel.
