Edit | Wu Shuo Blockchain
On July 7, 2023, a large amount of multi-chain assets worth about $125 million flowed abnormally out of the cross-chain protocol Multichain to multiple wallets, including 122 million assets (57.8m USDC, 1.024k WBTC, 7.214k WETH, 4.178m DAI, 491.657k LINK, 910.654k UNIDX, 1.493m USDT, 9.674m WOO, 1.297m ICE, 1.362m CRV, 134.48 TFI and 502.4k TUSD) flowing out of Multichain: Fantom Bridge; 6.835 million assets (4.83m USDC, 1.042m USDT, 780k DAI and 6.122 WBTC) flowing out of Multichain: Moonriver Bridge; and 666.47k USDC flowing out of Multichain: Dogechain Bridge. At present, Multichain asset bridge activity has been suspended, with the last transaction staying at 06:56 UTC+8 on July 7.
According to the deExplorer browser, some users are using DLN Trade to convert Fantom chain assets into assets on other chains at a discount. According to the latest transactions, 1 USDC on Fantom can be exchanged for about 0.9 USDC on BSC, 0.88 USDT on Polygon, etc., at a discount of about 10%.
Multichain’s official Twitter account stated that the locked assets on the Multichain MPC address had been abnormally moved to an unknown wallet, and the team was unsure of what had happened and is currently investigating. They also advised all users to stop using Multichain services and revoke all contract authorizations related to Multichain.
- The end of the NFT 1.0 era? Main features and positive aspects on the ruins
- Vitalik Buterin Talks About What Bitcoin Developers Can Learn from Ethereum’s Journey
- Approval of Bitcoin ETF could become one of the largest issuances in history.
Loki_Zeng, a researcher at New Fire Technology, analyzed that the abnormal outflow of funds from Multichain had the following characteristics: the transfer of assets lasted for a long time, a small amount of testing was conducted prior to the transfer with 2 USDC, each type of asset was transferred to an independent wallet, and there was no further action taken after that (such as transferring to an exchange, swap, or mixing). The receiving wallet was completely clean.
Based on these characteristics, it can be inferred that: 1) the transferor had ample time, and considering the technical characteristics of MPC, the transferor was likely to have obtained complete control over the private key fragments beyond the threshold in some way; 2) the “attack method” was very simple, just a simple transfer operation, without contracts, and there were tests, so the attacker was most likely not a hacker; 3) the transferor did not take further disposal and realization actions, and the operator may not have absolute decision-making power.
For more updates, please follow the official website link or Wu Shuo’s Twitter/Telegram channel:
https://www.wu-talk.com/index.php?m=content&c=index&a=show&catid=46&id=15885
Multichain Historical Events
On July 11, 2021, the pre-renamed AnySwap V3 was attacked and lost a total of 2,398,496.02 USDC and 5,509,222.73 MIM assets. The official analysis indicated that the reason for the attack was that two transactions with the same account signature appeared on the BSC chain. If these two transactions with the same account signature have the same r value of the rsv signature, the hacker can reverse deduce the private key of the account. The AnySwap team reproduced the hacker’s operation and promised to provide full compensation.
On December 21, 2021, after the renaming, Multichain announced the completion of a $60 million financing round, led by Binance Labs, with participation from Sequoia China, IDG Capital, Three Arrows Capital, DeFiance Capital, Circle Ventures, Tron Foundation, Hypersphere Ventures, Primitive Ventures, Magic Ventures, and HashKey.
On December 23, 2021, Multichain, which had just completed a huge amount of financing, became embroiled in a dispute over equity disputes. Co-founder and CEO Zhao Jun claimed to own 100% of the foundation’s equity, but the FUSION Foundation claimed that Qian Dejun owned 40% of the equity. Qian Dejun had participated in the founding of projects such as Quantum Chain, VeChain, and FUSION.
On January 18, 2022, Multichain discovered a critical vulnerability affecting six tokens (WETH, PERI, OMT, WBNB, MATIC, AVAX) and announced that the vulnerability had been successfully fixed. All user assets were safe, and cross-chain transactions were not affected. However, a security company discovered that the vulnerability had been exploited by hackers to steal coins, and the community called on users to revoke authorization as soon as possible. This security incident caused a loss of approximately $3 million in assets.
On January 13, 2023, Multichain launched its next-generation new technology product, zkRouter, and published the zkRouter white paper. zkRouter is a trustless, general-purpose cross-chain infrastructure with the advantages of trustless dependency, on-chain light computing, universality, low latency, and no asset collateral. As Multichain’s latest solution, zkRouter uses ZKP (Zero Knowledge Proof) to connect multiple blockchain networks and achieve seamless interoperability.
On March 15, 2023, Multichain announced that its total transaction volume had exceeded $100 billion. The total cross-chain user volume exceeded 830,000, with 5.04 million cross-chain transactions, an average single cross-chain fund of about $20,000, and Multichain is currently connected to 83 public chains, supporting more than 3,400 types of asset cross-chains, with cross-chain liquidity exceeding $1.8 billion.
On May 24, 2023, multiple users reported abnormal delays in the arrival of Multichain cross-chain funds. Multichain first responded on Discord, stating, “Due to the backend node upgrade taking longer than expected, all affected transactions will arrive after the upgrade is complete.” Later, they stated, “Some cross-chain routes are unable to be used due to force majeure, and the time for service restoration is unknown. After the service is restored, pending transactions will be automatically credited.” Meanwhile, Alfred Xu, co-founder of Multichain, responded to the news of the founder’s arrest by police in the Telegram community, stating, “The team is working normally.” On May 25, Qian Dejun, founder of the Fusion Foundation, stated that they were unable to contact Multichain founder Zhaojun and suggested “seeing if [they] can provide technical or other assistance, the most important thing is the safety of user assets and people.”
Subsequently, various parties affected by Multichain took action.
On May 25, Binance announced that it would suspend deposits for some bridged token networks, such as POLS-BSC, ACH-BSC, and BIFI-FTM, while waiting for a clear explanation from the Multichain team. On the same day, Andre Cronje (AC) stated that the Fantom Foundation had stopped providing liquidity for the MULTI token on SushiSwap. On the 27th, due to concerns about the stability of the primary USDC assets anyUSDC of Multichain and Fantom, LayerZero cross-chain bridge protocol Stargate released a proposal to disable the Fantom Pool and cross-chain paths, set the release of STG in the Fantom Pool to 0, disconnect the Fantom Pool from other liquidity pools, remove and unlock anyUSDC POL through Multichain, then deposit the POL into the Ethereum USDC Pool, and whitelist existing LPs.
On June 1, 2023, Multichain officially tweeted that over the past two days, the Multichain protocol had experienced multiple issues due to unforeseen circumstances. The team had done everything possible to maintain the protocol’s operation, but they were currently unable to contact CEO Zhaojun and obtain the necessary server access to perform maintenance. In the afternoon, the scan node network of Router5 had a problem, affecting the normal cross-chain service of some chains. Moreover, this problem exceeded the team’s current authority and capabilities. To protect the interests of the vast number of users, we have decided to temporarily suspend corresponding cross-chain services for the affected chains in the UI. Last week, the same issue occurred on Router2. We appreciate users’ understanding and request our partners to stop directly calling the Multichain protocol smart contract for cross-chain operations on affected chains. The affected chains are: Kekchain, PublicMint, Dyno Chain, Red Light Chain, Dexit, Ekta, HPB, ONUS, Omax, Findora, Planq.
Like what you're reading? Subscribe to our top stories.
We will continue to update Gambling Chain; if you have any questions or suggestions, please contact us!
