$120M Double Exploit On Thanksgiving

📢 Sponsor | 💡 Telegram | 📰 Past Editions

Happy Thanksgiving 🦃. I hope y’all spent some time off yesterday and touched some grass. In other news, Coinbase said that institutional investors are coming, and Grayscale BTC NAV discount hit its lowest since July 2021.

I’ve not been this bullish since early 2021 (NFA!)

In Today's Email:

• What Matters: Heco & Kyber exploit 🔓

• Founders Highlight: Guillaume of Panoptic 👨‍💻

• Deal Flows: Privy $18M Series A 💰

For faster news, subscribe to our telegram!

WHAT MATTERS

$86M Heco Bridge & $47M KyberSwap Exploits

State of play: A suspected exploit on HTX’s Heco bridge, which connects Ethereum and Heco Chain, resulted in a $86.6M loss according to PeckShield.

• The hacked funds were sent to DEX and sold for other tokens.

• PeckShield stated that there is a possibility of a “rug pull.”

• Cyver's analysis suggests a private key leak enabled hackers to access the Heco Chain-Ethereum bridge for unauthorized transfers.

• Igor Igamberdiev of Wintermute suspects a further HTX exploit, involving questionable transfers of $23.4M, according to The Block.

• According to Arkham data, HTX halted exchange withdrawals around 06:26 ET on November 22.

On the same day, KyberSwap also reportedly faced a $47M exploit, targeting its Elastic Pools liquidity solution, as indicated by on-chain data.

• The exploited funds comprised $20.7M on Arbitrum, $15M on Optimism, $7M on Ethereum, $3M on Polygon, and $2M on Base.

• KyberSwap alerted in a post about a "security incident" on KyberSwap Elastic and advised users to quickly withdraw their funds.

• A transaction message, seemingly from the attacker, stated: “Dear Kyberswap Developers, Employees, DAO members and LPs, Negotiations will start in a few hours when I am fully rested. Thank you.”

Doug Colkitt of Ambient Finance stated that the KyberSwap exploit is one of the “most complex and carefully engineered smart contract exploit” he’s ever seen:

• The KyberSwap exploit was unique to its implementation of concentrated liquidity. The attacker targeted the ETH/wstETH pool on Ethereum, using a similar strategy for other pools.

• The exploit involved a flash loan of 10,000 wstETH to manipulate price and liquidity.

• The attacker swapped wstETH into the pool to drastically change its price, creating a condition with zero existing liquidity.

• They then minted and burned specific amounts of liquidity to align numerical values for the exploit.

• The exploit manipulated KyberSwap's pool prices through two swaps, exploiting a liquidity math flaw to create an "infinite money glitch," allowing the attacker to gain substantial funds.

Why it matters: In the last 30 days, we’ve seen 5 hacks causing a total of $315M in losses including the HTX-Heco and KyberSwap exploits.

• Oct 30, Brian Krebs reported that more than $35M worth of crypto had been stolen in relation to the LastPass breach.

• Oct 31, Unibot confirmed on X that it had suffered a ~$640K token approval exploit in its new order router.

• Nov 10, Poloniex’s hot wallets were drained by hackers with an estimated loss of around $114M.

For builders and investors: Security is one aspect that can’t be underestimated when you’re building a crypto product, especially if you’re holding customers’ assets in any way, even if its temporary and non-custodial.

• Until we solve this problem, true “institutional players” would opt in for custodian-prime brokerage model like Fireblocks and Copper, instead of directly interacting with DeFi protocols.

IN PARTNERSHIP WITH

Raremints

Bear markets are the best time to find your next 10x crypto opportunity.

Subscribe to RAREMINTS to get daily Web3 insights straight to your inbox and stay ahead of the curve, for free.

Join 10,000+ investors and builders from Binance, KuCoin, Animoca Brands, and more 👇

BUILDER-INVESTOR HIGHLIGHT

Guillaume Lambert, Co-Founder & CEO of Panoptic

Guillaume Lambert is the co-founder and CEO of Panoptic, an Ethereum blockchain-based options trading protocol that is perpetual, oracle-free and offers instant-settlement.

Previous backgrounds: Lambert was an academic before transitioning into the crypto space. He has a PhD in physics from Princeton University and spent more than 10 years as an academic in several institutions.

• He was a postdoctoral researcher at NYU from 2011 - 2012 and a fellow at the University of Chicago from 2012 - 2015.

• He was a visiting scholar at Wyss Institute for Biologically Inspired Engineering from 2015 - 2016.

• Before Panoptic, he was an assistant professor at the School of Applied and Engineering Physics at Cornell University.

The big idea: Panoptic aims to develop a trustless, permissionless, and composable options product, i.e., to do for decentralized options markets what x*y=k automated market maker protocols did for spot trading.

Take a peek at our referral reward at the bottom of this issue. Share this newsletter and receive our list of 500 crypto VC individuals 👇

INSIGHTS

GBTC's NAV Discount Falls Below 10%

The Grayscale Bitcoin Trust (GBTC) discount to NAV dropped below 10% for the first time since July 2021.

• GBTC trades at a discount due to its non-redeemable shares, forcing shareholders to sell to buyers.

• It previously traded at a premium until the 2021 crypto credit crunch.

• GBTC shares were trading at $30.45 currently.

• GBTC surged about +25% in the past month after the SEC chose not to appeal a ruling on Grayscale's bid to convert its fund into a spot ETF.

• From 21 Nov to 22 Nov, Cathie Wood’s Ark Invest sold over $2M worth of GBTC.

DEAL FLOWS

Privy $18M Series A

Deal flows slowed down this week 📉 — we saw $80M+ in deals.

Privy, a startup specializing in blockchain tools for businesses (such as library for embedded wallets, authentication flows, and many more), secured $18M in a Paradigm-led Series A, with Sequoia, Blue Yard, and Archetype also participating.

• Paradigm co-founder and managing partner Matt Huang joined Privy's board of directors.

• Privy will use the funding to grow its team and enhance its library for developers creating on-chain apps.

• Privy has supported some of crypto’s most innovative companies including, friend.tech, Blackbird, and Courtyard.

Deal flows in the past week:

• Artifact, $2M Pre-Seed Round

• Vistara Labs, Undisclosed $ Pre-Seed Round

• IntentX, $2.5M Seed Round

• Sleek, $5M Seed Round

• OMTrade, $6M Seed Round

• Expanso, $7.5 Seed Round

• Saga, $5M Seed+ Round

• Panoptic, $7M Seed+ Round

• Matr1x Fire, $10M Series A

• Privy, $18M Series A

• Blast, $20M Private Round

QUICK BITES

• KyberSwap exploited for $47M.

• Blast L2 hits $300M TVL amid scrutiny.

• Bitcoin’s hash rate hits an all-time high.

• Korea plans to pilot CBDC with 100,000 citizens in 2024.

• Singapore plans more rules for retail crypto speculation.

• US Prosecutors want CZ to stay in the US until sentencing.

• GoldenTree Partner left the firm, he led the push to crypto.

• Aragon DAO votes to fund legal action against its founders.

• A Bitcoin Sender overpays a record-breaking $3M transaction fee.

• GBTC NAV hits less than -10% discount for the first time since July 2021.

NOTEWORTHY READS

• 0xsmac’s read on a crypto future, part 2.

• Anoma’s read on incent-centric topology.

• David Phelps’ read on ETH Devconnect Istanbul takeaways.

If you enjoy reading this issue, please consider subscribing. It takes 1 minute of your time but it would mean the world to us 🙇

Disclaimer: All the information presented in this publication and its affiliates is strictly for educational purposes only. It should not be construed or taken as financial, legal, investment, or any other form of advice.