Defrost Finance ‘Hacked’ for $12 Million, Security Firms Call it a Rug Pull

Defrost Finance said it lost $12 million in two hacks last week.
Blockchain security firm PeckShield says community intel suggests it was a rug pull.
Certink said that Defrost Finance hack was an “exit scam.”

The DeFi protocol Defrost Finance suffered a hack that lost its users approximately $12 million. The attack raised suspicion among some security analysts, saying that the hack was actually a rug pull.

On Sunday, blockchain security firm PeckShield cited community intel that warned them about the rug pull. The firm said the attackers made it out with $12 million of user funds.

Blockchain security and auditing firm CertiK said on Monday that the Defrost Finance hack was an exit scam. CertiK said they attempted to contact multiple team members but have not received any response. They also added that they are using all the information they help authorities find Defrost Finance members.

Defrost Finance acknowledged the hack on Sunday. They said they would negotiate with the hacker, offering 20% of the funds if he returned the assets.

“We are willing to discuss sharing 20% (negotiable) of the funds in exchange for the bulk of assets and are calling on the hackers to contact us asap,” Defrost’s team said.

How the Hack Happened

Defrost Finance said that it suffered two attacks on Friday. The first attack was a flash loan, in which the firm lost about $173,000.

They also said they suffered a second, “much larger” attack. The second attack saw the firm lose its private key, which gave the attacker access to funds in the Defrost V1 protocol.

“We are currently working on finding out how exactly the aggressors managed to obtain the key and used it to exploit the protocol,” the company wrote.

Security firm PeckShield said its analysis shows that the attacker used a fake collateral token and a malicious price oracle. These allowed the attacker to manipulate the price of the tokens and transfer the funds to their wallet.

What is a Rug Pull?

A rug pull is a type of scam in which the developers establish a liquidity pool for a project and then suddenly withdraw the majority of its funds. The term comes from the idea that they have pulled the rug out from under their investors. This leaves investors holding tokens with little or no liquidity, resulting in losses for the investors.

A rug pull is a type of exit scam, referring to a scam in which developers collect investors’ funds and then disappear. It typically happens when projects are still in their early stages and developers are unknown to the public. Often, the project team will blame hackers for the lost funds.

Rug pulls are rising in the DeFi space, despite a slowing down in crypto markets. An earlier report by Solidus Labs says rug pull scams jumped 41% this year.

On the Flipside

So far, there is no definitive proof that the project is an exit scam.

Why You Should Care

The rug pull has become a major problem in the DeFi space. It is important to do due diligence on any project before investing, as the lack thereof can lead to substantial losses. Developers may also use exit scams to collect funds and disappear without delivering a product or service.