CHAINSWAP

DESCRIPTION OF EVENTS

"The cross-chain hub for all chains." "ChainSwap is a bridge protocol that links the Ethereum and Binance Smart Chain (BSC) blockchains." "It supports Binance Smart Chain, Ethereum, Polygon, and Huobi Eco Chain." "ChainSwap is a cross-chain asset bridge & application hub for smart chains. ChainSwap allows projects to seamlessly bridge between ETH, BSC and HECO. In the future ChainSwap will be integrating chains and provide full cross-chain solutions between BTC, DOT, SOL and more."

"On July 2nd at 04:30 AM UTC ChainSwap got exploited." The exploit "resulted in the loss of $800K."

"[W]e noticed an anomaly on the bridge, some users reported that their coins were actively withdrawn from wallets that interacted with ChainSwap."

"Upon discovery ChainSwap team immediately froze the bridge, shut down all nodes and a fix was deployed within 30 minutes. Local police authorities, Huobi & OkeX which the attacker interacted with to withdraw/deposit funds got immediately contacted. Team’s of affected projects got alerted."

"The attacker has since returned 2.2M RAI after ChainSwap tracked stolen funds to Huobi and OKEx exchanges." "With the help from local police and OKex the ChainSwap team managed to obtain the attacker’s email. Negotiations started. The ChainSwap team managed to negotiate back CORRA and RAI tokens."

"Since the RAI Finance team found out that the ChainSwap contract was attacked and the RAI assets were stolen yesterday, the team has actively communicated with the trading platform, the community and other parties. At present, Huobi and Bithumb have suspended the deposit of the RAI, and the RAI trading price is currently maintained at a stable level. At present, the hacker has returned 2.2 million RAI to the ChainSwap Deployer address: [0xc96ecc8456cd0e5b20c1c40989adad9c1809da9c]. RAI Finance’s loss due to this incident was reduced to 670,000 RAI. In the future, the RAI Finance team will continue to pay attention to this matter and actively communicate with all parties. The team will announce other developments with the community as soon as possible."

"Total damage from the hack is estimated to be around $800,000. For small amounts, the ChainSwap team bought back affected tokens from the market and refunded wallets accordingly. For the rest, we are working with project teams to set up compensation plans. Full compensation is almost completed. In addition to compensation, we will prepare bonuses for users who are affected and it will be carried out accordingly in the coming days."

"Full compensation is almost completed. All affected users will be compensated from the ChainSwap treasury."

"ChainSwap v2 is launching in the upcoming months. The ChainSwap team will be hiring more auditing firms to perform audits."

ChainSwap is a smart contract which gives users the ability to move tokens between chains using their protocol. The protocol depends on storing funds in smart contract hot wallets.

On July 2nd, an exploit allowed attackers to steal $800k from the smart contract. ChainSwap is using their treasury to recover the losses.

HOW COULD THIS HAVE BEEN PREVENTED?

Theoretically, decentralized finance will eventually result in hackers having exploited every vulnerability that exists. However, it's impossible to know when that will occur and if a contract is truly secure, as opposed to there still being an exploit that just hasn't been noticed yet. For any complex smart contract, it's impossible to prove security and plenty of fully audited contracts have been exploited.

In this situation, there was luckily not much taken, and it was all ultimately reimbursed from the treasury. Platforms should, generally, be prepared for the full loss of all assets stored in hot wallets (including smart contracts). Assets that do not need to be accessed quickly should be stored securely in a simple offline multi-signature wallet.

Check Our Framework For Safe Secure Exchange Platforms

Example Domain (Mar 23)
No Title (Jul 24)
ChainSwap post-mortem and compensation plan | by ChainSwap | Medium (Jul 24)
Hacker Has Returned Part Of The Rai Stolen Due To A Loophole In The Chainswap Contract (Jul 24)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
Chain Swap (Aug 22)
Morioh (Aug 22)
Address 0x941a9e3b91e1cc015702b897c512d265fae88a9c | Etherscan (Aug 29)
Random Numbers Don’t Lie: A Closer Technical Look into Recent DeFi Hacks (May 7)

More case studies

DDEX XDX Swap
Backdoor

DEXTools
Token Minting