Three crypto attacks in two days drain projects of millions

In less than two days, criminals attacked at least three crypto platforms, draining millions and leaving teams fighting for the stolen funds and survival.

The most recent incident was spotted today, as crypto security specialist CertiK warned that GriffinAI, a developer of customizable AI agents for the crypto industry, lost around $3 million worth of GAIN tokens in an attack.

"The attacker initialized a false LayerZero Peer on Ethereum, then bridged 5B fake tokens it created to mint 5B $GAIN on [BNB Smart Chain, BSC]," CertiK said, adding that the stolen funds were eventually sent to the Tornado Cash crypto mixer.

The GriffinAI team confirmed the attack, saying that its native token "experienced abnormal minting and dumping, leading to a sharp price drop."

After that, the team reported that it had "formally requested all exchanges to pause trading, deposits & withdrawals of $GAIN (BSC)." At the time of writing, the token is down 87% in a day.

Meanwhile, in a separate attack on Wednesday evening, Ideal Protocol, a Web3 on-chain governance protocol, lost around $1 million worth of tokens, according to crypto security specialist Blockaid.

"The root cause is an uninitialized contract with poor access control. Initialize() could be called by anyone, letting the attacker seize ownership,” it explained in a post on X.

Once in control, they used ownerWithdraw() to drain funds from the protocol," it explained, adding that the criminals paid a $280K miner bribe to secure the block. However, Ideal Protocol hasn’t issued an official statement on the matter.

In the third incident, which happened on Tuesday, Web3 incubator and launchpad Seedify lost $1.2 million, accusing North Korean hackers of carrying out the theft, as they apparently accessed Seedify developers’ private keys. (Blockchain sleuth ZachXBT also noted that the Seedify theft addresses are linked to other thefts attributed to North Koreans).

"Using these, they were able to mint a large amount of SFUND tokens through a bridge contract that had previously passed audit," Seedify said, promising to "be in touch with" its auditors and security experts to review the security of all of their other infrastructure.

In either case, it stressed that this incident was limited to a compromised wallet’s minting privileges and that their core contracts, user wallets, website, and underlying protocol were unaffected.

"DPRK/Lazarus decided to take everything we built over 4.5 years in one hack. We audited these contracts through the most well-known audit company so that we wouldn't face this kind of issue, but they found a gap, and still did," the founder of Seedify, known as Meta Alchemist, said.

However, the team has already announced a plan to recover from the theft.