Multichain was hacked again, with a liquidity loss of more than 130 million US dollars

Original article: "Multichain crisis reappears, more than 130 million US dollars in token liquidity has been withdrawn"

Author: BitpushNews Mary Liu

In the early hours of July 7th, Beijing time, PeckShield, an on-chain security company, discovered that multiple cross-chain bridge contracts operated by Multichain experienced a large number of token outflows.

At press time, more than $130 million worth of token liquidity has been withdrawn. Multichain’s Fantom Network, Moonriver, and Dogecoin bridge contracts were all affected. The Fantom Bridge alone suffered a liquidity loss of more than $120 million. Outflow tokens included 58 million USDC, 1,020 WBTC ($30.9 million), 7,200 WETH ($13.7 million) and 4 million DAI, also includes other tokens such as Chainlink, Curve DAO, YFI, Wootrade Network and nearly a quarter of the total supply of UniDex.

Multichain is powered by multi-party computation involving 21 nodes, the combination of which is required to sign transactions authorizing the flow of funds, which the team has yet to issue a statement on. The Fantom Foundation stated that it is aware of "what is happening on the Multichain bridge...we are actively evaluating the situation and will provide an update as soon as we have more information to share."

Guess the reason?

So far, the assets have not been sold or transferred to the cryptocurrency mixing service, which PeckShield speculates may have been a hack caused by a security breach.

Curve Finance official tweet warned: "Multichain may be hacked. Withdraw all Multichain assets, if you have any".

PeckShield also speculates whether this has something to do with cross-chain platform LayerZero adding support for four tokens to match those being transferred, but that doesn’t match the full list of transferred tokens.

LayerZero CEO Bryan Pellegrino responded that Multichain’s outflow had nothing to do with the platform.

“This is a multichain hack, it’s 100% unrelated to LayerZero,” he said. Pellegrino believes that Multichain bridge users may be able to extract assets and bring them to LayerZero.

Igor Igamberdiev, director of research at IWintermute, pointed out that it is strange that the wallet that received a large amount of USDC also performed transactions from the old Binance Smart Chain bridge a few hours ago.

It is not clear whether Binance has stopped supporting the deposit and withdrawal of Multichain cross-chain bridge tokens.

Binance announced earlier that it will stop all deposits and withdrawals of ten Multichain bridge tokens that bridge to Binance Smart Chain, Ethereum, Avalanche, and Fantom, including Polkastarter (POLS), Alchemy Pay (ACH), Beefy.Finance (BIFI) and Harvest Finance (FARM), among others, Travala (AVA), a token minted on the Ethereum bridge, are also included. But users can still withdraw them through other networks supported by the exchange.

Cross-chain bridge problems continue

Cross-chain bridges are a common target for cryptocurrency hackers, and the Multichain bridge, formerly known as Anyswap, was hacked for $8 million in 2021. In early 2022, multiple hackers stole $3 million from Multichain. A white hat hacker later returned $900,000 of that amount.

Since the beginning of this year, Multichain has experienced several technical failures, and its potential crisis has aroused investors' vigilance.

In May, the Multichain project encountered difficulties processing bridge transfers, resulting in a large number of transactions being stuck. Multiple paths of Multichain cross-chain bridges, including Kava, zkSync, and Polygon zkEVM cannot operate. The team also confirmed that CEO Zhaojun could not be reached, and there were rumors in the community that Zhao was detained in China, and the team did not update any follow-up information.

Ethereum co-founder Vitalik Buterin has warned users against relying on cross-chain bridges, advising people to "minimize reliance on bridges" and that users should "keep assets on the chain from which they originated," he said in a blog post this year. .

According to DeFiLlama, the Multichain bridge currently manages approximately $1.28 billion in assets minted through its cross-chain platform. This includes $693 million minted on Ethereum, $337 million minted on BSC, and $91 million minted on Fantom.

According to the comparison terminal data, Multichain’s native token MULTI fell by 22.15% last month. As of press time, the trading price of MULTI was $2.84, a drop of nearly 10% in 24 hours.