Address Suffers 35 Million Loss from Phishing Attack Causing Serious Unpegging of DETHWETH

Address Suffers 35 Million Loss from Phishing Attack Causing Serious Unpegging of DETHWETH

Address Suffers 35 Million Loss from Phishing Attack Causing Serious Unpegging of DETHWETH

According to the data monitored by the blockchain security company Scam Sniffer, a certain encrypted wallet address signed a “permit” phishing signature on the second-tier network Blast, resulting in a loss of 15,079 fwDETH (DETH packaged tokens), worth approximately $35 million. The stolen address has been marked by the on-chain intelligence company Arkham as suspected to belong to the cryptocurrency venture capital firm Continue Capital.

The on-chain data analyst Yu Jin added that the phishing perpetrator later converted the stolen assets into Ethereum (ETH). However, due to insufficient liquidity pool depth on the decentralized exchange, only 2,288 ETH was exchanged for the 14,079 DETH, and the liquidity pool was drained, causing the DETH/WETH to become highly unanchored. The value of the stolen assets shrank by 85%, from $35.98 million to $5.5 million.

DETH is a Duo Re-Staked Token (DRT) created by the Duo Exchange’s Duo Yield Exchange Protocol. According to the protocol’s documentation, for each deposit made by a liquidity provider (including native ETH, WETH, or USDB), Duo Exchange will mint an equivalent amount of DETH or DUSD. These DRTs can be further used in other protocols, such as collateral, exchange, or leveraged trading.

Duo Exchange has stated on social media platforms that they are investigating the phishing attack, and mentioned that DRT can be redeemed for the original principal at a 1:1 ratio according to the design. Some members of the cryptocurrency community have taken advantage of this for arbitrage, but others believe it carries risks. According to GeckoTerminal’s data, the trading price of DETH was approximately $1,200 and the price of ETH was around $2,400 at the time of publication.

Update: Lin Xiaohong, co-founder of Continue Capital, posted this afternoon, “I inadvertently exposed that I didn’t retire, and I passively made the headlines for charity.” Combining the aforementioned hacking incident and Arkham’s markings, the address that was attacked earlier may be his.