QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$1 500 000 USD
FEBRUARY 2021
GLOBAL
BT FINANCE
DESCRIPTION OF EVENTS
"BT.Finance is a multi-chain smart DeFi yield aggregator targets the best and sustainable yield for tokens." "The Vaults are divided into 3 pools as Stable Profits Pool, High Yield Pool, and Smart Hybrid Pool to all users with various risk tolerances. The BT Vault V1 is to earn $CRV $SUSHI $PICKLE $BAS from other excellent DeFi yield aggregators and platforms, thanks for their innovative products and hard work. BT Vault V2 will develop smart hybrid strategies and launch it on BSC, Heco and other chains."
"DeFi Project BT.Finance announced through its official Twitter that it was exposed to hacking attacks. It added that the deposit of Curve.fi will be suspended and security will be strengthened in the additional attack prevention measures. It also requested that hackers voluntarily return funds for investor protection and good development of the DeFi industry. Meanwhile, BT.Finance explained that with the withdrawal fee protection function, it was able to reduce damages worth $140,000 during this hack." "We have deposited 17.88ETH, 69482USD, and 34104USDT for hacker withdrawals into ETH, USDC, USDT strategy addresses to reduce user losses."
"The development team has been analyzing the attack and the final technical solution together with the audit team today. But the current final solution will take time. We will launch the V2 version to completely solve the problem." "By building the constructor self-destruction contract, the exploiter bypassed our defense, which was the same as yDAI attack principle." "In order to strengthen the defense, we have increased the withdrawal fee of ETH, WBTC, USDC within 24 hours to 15%, USDT is 10%, so please do not withdraw within 24 hours, thank you!"
"We have governance funds for insurance and compensation, but we still say sorry for this incident." "We have contacted @peckshield for the first time to seek help and take countermeasures, thanks for their help!" "We hope that the hacker can return the funds for the sound development of our investors and DeFi, and we will use $BT to conduct a thank you bug test."
"We have contacted dozens of exchanges such as @binance @coinbase for help, once the stolen asset is deposited in the exchange, it will be frozen." "Meanwhile, We have already called the police in Singapore and will entrust a lawyer to deal this exploit. We still hope that the hacker can take the initiative to return funds for our users, We will use $BT tokens as a bug bounty for him."
"[U]sing a nice flash loan (100k ETH = $170M dydx), @btdotfinance's hacker is now using @TornadoCash to invest his money (>$1.4M). some nice use of cross asset swaps mechanism from Curve (notice the NFT in the tx) as well."
"All the bugs of v1 have been fixed." "We invited one more professional and technical expert from a security industry to takepart in our developing work. We will avoid financial logic errors as much as possible with his review." "We have created a bounty program in cooperation with the leading bug bounty platform @immunefi. The bonus fund is up to $100,000. All white hat hackers are welcome to find bugs for us."
"The block snapshot and stolen addresses confirmation has been completed already!" "Now the affected users can claim the IOU Token ($BTU) of BT.Finance. Thanks for your kindly waiting patiently!!!" "This compensation claim is for the loss of users who staked $ETH $USDT and $USDC in the exploit." "[T]he compensation solution is being implemented."
A large group of people decided to make a clever puzzle that held their money. The puzzle was solved by an unscrupulous puzzle solver, who then proceeded to keep their money, despite being asked nicely to return the money multiple times.
The puzzle maker has declared that the new version of their puzzle is completely unsolvable. Affected users have been given IOU tokens.
HOW COULD THIS HAVE BEEN PREVENTED?
Rather than storing funds in large complicated puzzles that may or may not have solutions, it makes sense to store the majority of funds in offline wallets that require multiple signatures to unlock.
Rekt - Leaderboard (May 13)
Rekt - The Big Combo (Growth DeFi - REKT) (May 16)
Ethereum Transaction Hash (Txhash) Details | Etherscan (May 19)
publications/peckshield-audit-report-btdotfinance-v1.0.pdf at master · peckshield/publications · GitHub (May 19)
BlockThreat Week 6 2021 (May 19)
Bt Finance Exploit Analysis Report (May 19)
DeFi Project BT.Finance, Hacking Damage - 0xFintech (May 19)
BT Finance exploited. Over 1.5m funds drained VIA Flashloan (May 19)
BT Finance-Best DeFi Yield Farming Aggregator For Tokens (May 19)
@btdotfinance Twitter (May 19)
@btdotfinance Twitter (May 19)
@btdotfinance Twitter (May 19)
BT Finance Bug Bounties | Immunefi (May 20)
Week 14 Updates Cmc Listed Bt Compensation Solution Was Implemented V2 Is Coming (May 20)
Cover Protocol Claim Briefing 3 Bt Finance (May 20)
CVC Statements for Claim filed on 02/04/2021 for BT Finance - CVC - Cover Protocol (May 20)
SlowMist Hacked - SlowMist Zone (May 18)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
Rekt - The Big Combo (Growth DeFi - REKT) (Aug 11)
