#Security #Exploit #DeFi #Clarity #BitMEX ☠️
📉 $40M in one day: four hacks, two shutdowns
1️⃣ BitMEX shuts down September 23
The exchange that invented the perpetual swap with 100x leverage - the derivative that now dominates crypto trading volume across every major venue - is ending its 11-year run.
Registration is already closed. From August 26, only position closures are accepted. After September 23, unclaimed funds are charged the higher of $50 or 1% annually per month.
Worth noting: across 11 years, BitMEX never lost customer funds to an external hack. The shutdown comes one month after a simultaneous replacement of its CEO, CFO, and Head of Growth.
2️⃣ Balance Coin collapses 99% - the Terra comparison isn't a stretch
An attacker manipulated the BTCB price oracle on Binance, triggering wrongful liquidations of 42DAO vaults.
Losses came to ~$915,000, with BLC crashing from $1 to ~$0.0014.
The Clarity Act moving through the Senate draws a hard line between reserve and algorithmic stablecoins. Reserve stablecoins back each token with a liquid asset; algorithmic ones maintain their peg through mechanisms.
Under the proposal, if a project goes bankrupt, customer assets stay ring-fenced - they don't become part of the creditor pool. Negotiations with Democrats are still ongoing; the bill isn't law yet.
3️⃣ AFX Trade + B² Network - $28M in hours
🟢 AFX Trade (perp-DEX on Arbitrum): $24.15M drained after bridge validator private keys were compromised. Funds converted to ~12,467 ETH. The protocol offered the attacker a 30% white-hat bounty for returning the rest.
🟢 B² Network (BTC L2 on BNB Chain): $3.86M via staking contract exploit. Assets moved to NEAR Intents and HOT Protocol. Team has committed to compensating affected users.
4️⃣ Verus hit twice in two months - and SecondFi closes
🟢 SecondFi (formerly Yoroi by EMURGO): ~$2.6M ADA stolen via a vulnerability in transaction generation software. The team has announced the project is shutting down.
🟢 Verus Bridge: $7.54M - second hack in two months. Same vulnerability class as May, when ~3,916 ETH went to Tornado Cash. After May, the funds were returned and placed 🤡 back in the same contract. Two weeks later it was cracked again.
✨ The Clarity Act is moving in the right direction. The next algorithmic stablecoin failure shouldn't be able to drag customer assets into a bankruptcy estate.
Until it passes, bridges and algorithmic protocols warrant a hard risk calculation - not trust in audit reports.
➡️Crouton.digital | About us⬅️
📉 $40M in one day: four hacks, two shutdowns
July 23 made a clean argument. Four protocols lost a combined ~$40M in under 24 hours, one project announced immediate closure, and a veteran exchange named its final date. Attacks don't slow in a bull market - bigger TVLs just mean richer targets.
1️⃣ BitMEX shuts down September 23
The exchange that invented the perpetual swap with 100x leverage - the derivative that now dominates crypto trading volume across every major venue - is ending its 11-year run.
Registration is already closed. From August 26, only position closures are accepted. After September 23, unclaimed funds are charged the higher of $50 or 1% annually per month.
Worth noting: across 11 years, BitMEX never lost customer funds to an external hack. The shutdown comes one month after a simultaneous replacement of its CEO, CFO, and Head of Growth.
2️⃣ Balance Coin collapses 99% - the Terra comparison isn't a stretch
An attacker manipulated the BTCB price oracle on Binance, triggering wrongful liquidations of 42DAO vaults.
Losses came to ~$915,000, with BLC crashing from $1 to ~$0.0014.
💭 Cynthia Lummis, U.S. Senator:
"The collapse of Terra destroyed approximately $40 billion, and what was left was consumed by bankruptcy proceedings."
The Clarity Act moving through the Senate draws a hard line between reserve and algorithmic stablecoins. Reserve stablecoins back each token with a liquid asset; algorithmic ones maintain their peg through mechanisms.
Under the proposal, if a project goes bankrupt, customer assets stay ring-fenced - they don't become part of the creditor pool. Negotiations with Democrats are still ongoing; the bill isn't law yet.
3️⃣ AFX Trade + B² Network - $28M in hours
🟢 AFX Trade (perp-DEX on Arbitrum): $24.15M drained after bridge validator private keys were compromised. Funds converted to ~12,467 ETH. The protocol offered the attacker a 30% white-hat bounty for returning the rest.
🟢 B² Network (BTC L2 on BNB Chain): $3.86M via staking contract exploit. Assets moved to NEAR Intents and HOT Protocol. Team has committed to compensating affected users.
4️⃣ Verus hit twice in two months - and SecondFi closes
🟢 SecondFi (formerly Yoroi by EMURGO): ~$2.6M ADA stolen via a vulnerability in transaction generation software. The team has announced the project is shutting down.
🟢 Verus Bridge: $7.54M - second hack in two months. Same vulnerability class as May, when ~3,916 ETH went to Tornado Cash. After May, the funds were returned and placed 🤡 back in the same contract. Two weeks later it was cracked again.
🤔 The pattern is hard to miss. Protocols patch the symptom; the underlying vulnerability class stays open. Verus is the cleanest example - funds recovered, same broken contract redeployed, second drain within weeks.
AFX's 30% bounty structure is rational from a recovery standpoint. It doesn't patch the hole.
✨ The Clarity Act is moving in the right direction. The next algorithmic stablecoin failure shouldn't be able to drag customer assets into a bankruptcy estate.
Until it passes, bridges and algorithmic protocols warrant a hard risk calculation - not trust in audit reports.
➡️Crouton.digital | About us⬅️