MM.finance

MM.Finance, the largest DeFi exchange on Cronos, has lost US$2 million in a recent exploitation by hackers. A Domain Name System (DNS) vulnerability is believed to be responsible, with the stolen funds being sent to Tornado Cash:

1/ We have been investigating the onchain tx & also engaged partners w/ extensive connections & expertise in escalating this in terms of real world consequences. We have traced your funding to OKX exchange & we need everyone's help to RT this post to get @okx & @Jay_OKX pic.twitter.com/4PhBrR5yfu
— MM.Finance – #1 Defi Ecosystem on #Cronos (@MMFcrypto) May 5, 2022

As per its tweet, MM.Finance traced the perpetrator of the cyberattack back to OKX centralised exchange. The funds stolen in the frontend breach were bridged to Ethereum using Multichain and deposited into Tornado Cash. OKX requires users to go through a ‘know your customer’ procedure, therefore the attacker had to have used fake IDs when signing up for the exchange.

While MM.Finance intends to compensate the affected addresses, the exchange has said that if 90 percent of the funds are not returned to MM.Finance within 48 hours, it will contact the FBI:

📍 We have collated the addresses that have lost funds during the attack earlier via the data onchain. Over $2,000,000 USD will be compensated and reimbursed.

✅ To check if you qualify, you can head to https://t.co/XamyJ444g2 and key in your wallet address. pic.twitter.com/SYWMYPbfs6
— MM.Finance – #1 Defi Ecosystem on #Cronos (@MMFcrypto) May 5, 2022

DeFi Exploits Increasing

Early April saw DeFi lender Inverse Finance suffer a US$15.6 million exploitation. The decentralised Ethereum protocol was compromised by hackers targeting its money market through the artificial manipulation of its token prices.

And, only days ago, Rari Capital lost US$80 million to hackers following a Fei protocol exploit. The assets had been held in Fuse lending pools, apparently the fault of a reentrancy vulnerability.