Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnWeb3SquareMore
Trade
Spot
Buy and sell crypto with ease
Margin
Amplify your capital and maximize fund efficiency
Onchain
Going Onchain, without going Onchain!
Convert
Zero fees, no slippage
Explore
Launchhub
Gain the edge early and start winning
Copy
Copy elite trader with one click
Bots
Simple, fast, and reliable AI trading bot
Trade
USDT-M Futures
Futures settled in USDT
USDC-M Futures
Futures settled in USDC
Coin-M Futures
Futures settled in cryptocurrencies
Explore
Futures guide
A beginner-to-advanced journey in futures trading
Futures promotions
Generous rewards await
Overview
A variety of products to grow your assets
Simple Earn
Deposit and withdraw anytime to earn flexible returns with zero risk
On-chain Earn
Earn profits daily without risking principal
Structured Earn
Robust financial innovation to navigate market swings
VIP and Wealth Management
Premium services for smart wealth management
Loans
Flexible borrowing with high fund security
Delta Prime hacker exploits token minting to steal $6 million in funds

Delta Prime hacker exploits token minting to steal $6 million in funds

GrafaGrafa2024/09/16 22:15
By:Liezl Gambe

A hacker exploited the Delta Prime decentralized finance (DeFi) protocol to steal over $6 million by minting an arbitrarily large number of deposit receipt tokens. 

According to data from block explorer Arbiscan, the attacker created over 115 duovigintillion Delta Prime USD (DPUSDC) tokens, an astronomical figure represented as 1.1*10^69 in scientific notation. 

These DPUSDC tokens are deposit receipts for the USDC (CRYPTO:USDC) stablecoin held on Delta Prime, designed to be redeemable at a 1:1 ratio.

Despite minting such a vast number of tokens, the attacker only burned 2.4 million DPUSDC, exchanging them for $2.4 million worth of USDC. 

The attacker repeated similar steps for other tokens, such as Delta Prime Wrapped Bitcoin (DPBTCb), Delta Prime Wrapped Ether (DPWETH), and Delta Prime Arbitrum (DPARB), redeeming only a small fraction to obtain over $1 million in Bitcoin (CRYPTO:BTC), Ether (CRYPTO:ETH), Arbitrum (CRYPTO:ARB), and other assets.

Blockchain security specialist Chaofan Shou estimates the total amount stolen so far to be around $6 million. 

The attacker managed to gain control by compromising an admin account, likely by stealing the developer’s private key. 

Using this access, the attacker executed an “upgrade” function on the protocol’s liquidity pool contracts. 

Instead of upgrading the software, these functions allowed the attacker to point each proxy to a malicious contract that enabled the minting of an unlimited number of deposit receipts, effectively draining the pools of funds.

Delta Prime acknowledged the breach, stating, "At 6:14 AM CET DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M." 

The protocol assured that its Avalanche (CRYPTO:AVAX) version, DeltaPrime Blue, was not affected and mentioned that insurance would cover any potential losses "where possible/necessary."

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Locked for new tokens.
APR up to 10%. Always on, always get airdrop.
Lock now!