ARMOR FINANCE

DESCRIPTION OF EVENTS

"Armor is a decentralized brokerage for cover underwritten by Nexus Mutual's blockchain-based insurance alternative." "Armor is the first insurance aggregator for DeFi. Leveraging the underwriting capability of Nexus Mutual, it offers pay-as-you-go insurance products and the ability to buy insurance covers without KYC."

"It is the second iteration of the yInsure product from Yearn Finance. The first iteration of yInsure failed after the yInsure’s founders had a fallout. Yearn Finance chose to partner with COVER instead after the event and leave the yInsure product to Armor. During launch, there are four main products, arNXM, arNFT, arCORE and arSHIELD."

"Beyond earning tokens from providing liquidity and staking their purchased cover, users can also purchase tokens when they are available through Armor.Fi’s institutional partner. In anticipation of the investors who might want to own Armor tokens in larger quantities, the team has partnered with Bering Waters OTC to service institutional buyers in the secondary market.'

"The Armor team claimed that some team members were scammed by OTC and were defrauded of 1.2 million ARMOR tokens."

"A scammer took 1.2m ARMOR tokens from a team member which they have already finished dumping for approx. 600 ETH ($850k USD). Nothing was hacked, the project remains safe and @ArmorFi can recover from here."

"A sophisticated social engineering scam took place across telegram and discord where a scammer posed as a strategic investor, wanting to buy OTC." "While Armor has an official OTC broker, with whom they were introduced, the broker was away at the time and the scammer said they wanted to close the transaction within the hour while their trader was online." "They then suggested another team member could be escrow and it seemed reasonable that the broker could catch up with it later. One team member, remaining unnamed on this thread, was available to be escrow." "This non-dev team member acting as escrow was up late around 1am his time, and was scammed out of the tokens having been tricked with fake accounts following receipt of escrowed tokens, where he did not follow basic OpSec to verify transactions."

"An attacker impersonated an influential OTC investor at Discord. It reached two members of the ArmorFi team in order to close transactions in a rush. One of the "non-dev" team members was chosen as escrow. Then, attackers sent fake proof of finalized transactions revealing his negligence."

"The scammers have already dumped all tokens for a profit of 600 ETH (approximately US$850,000). The Armor team disclosed that the scammers pretended to be strategic investors on social media, falsely claiming to purchase tokens from the team through OTC, defrauded 1.2 million ARMOR tokens in OTC transactions, and then sold them. According to the Armor team, "No hacking, the project is still safe.""

"Analyst Taha Zafar noticed that ArmorFi did not prepare an ICO or a private sale, so the whole story about large-scale OTC deals looks "funny" to him."

"Community support to help investigate and prevent these stolen funds from being usable for the hacker will be appreciated."

"The team has already implemented better security practices against social engineering attacks in the future, so an event like this will not recur." "Long term view this is a tiny bump on the road for Armor and a benefit to the growth and security of DeFi by sharing our story so others can be safer going forward."

Armor Finance is an insurance protocol which according to CryptoBriefing, didn't honour a claim for $1.6m and kept funds for themselves.

At one point, they were tricked by a thief into sending Armor tokens for free, when a member of their development team didn't check a transaction that was supposed to act as escrow.

HOW COULD THIS HAVE BEEN PREVENTED?

It was very clear from this incident that the member of the Armor team did not have the training or care to check over the transaction. Even if fully trained, this is an illustration of the problem of relying on a single person to validate a transaction. Were others on the team required to validate the transaction, it is almost certain that the deception would have been caught.

Check Our Framework For Safe Secure Exchange Platforms

SlowMist Hacked - SlowMist Zone (May 18)
@ArmorFi Twitter (May 26)
ARMOR price, chart, market cap and info | CoinGecko (May 26)
FuruCombo (COMBO) and ArmorFi (ARMOR) DeFis Attacked Today, $15 Million Lost. Here's What Happened (May 26)
@taha_zafar12 Twitter (May 26)
FuruCombo Combo I ArmorFi Armor DeFis (May 26)
Armor Finance Denies User $1.6 Million Insurance Claim | Crypto Briefing (May 26)
Armor.Fi New Liquidity Incentives and Institutional Partner - DeFi Rate (May 26)

More case studies

Furucombo
DeFi Hack

Nimbus Platform
Liquidity Attack