SHEZMU

DESCRIPTION OF EVENTS

"Shezmu introduces a groundbreaking hybrid Collateralized Debt Position (CDP) platform that innovatively combines the capabilities of both NFTs and Yield-Bearing Tokens. Our platform allows users to borrow against both NFTs and Yield-Bearing Tokens, providing unparalleled flexibility and liquidity in the digital asset space. In addition to the core CDP functionality, our project offers a suite of utilities designed to enhance user experience and asset value."

"Users can use their NFTs and Yield-Bearing Tokens as collateral to secure loans, unlocking liquidity without relinquishing ownership of their valuable digital assets."

"Oasis supports a wide array of both NFTs and Yield-Bearing Tokens, ensuring users can maximize their assets' potential."

"Shezmu failed to scrutinize their September 3rd contract upgrade, leaving the door wide open for an enterprising hacker."

"One of their vaults used collateral that can be minted by anyone. With the free collateral, the attacker can borrow an arbitrary amount of $ShezUSD."

"@ShezmuTech has been hacked / rugged. ~$4.9M worth of $ShezUSD stolen."

"Due to low liquidity, these $4.9M worth of $ShezUSD are swapped to only $700K."

"One of the ShezUSD vaults has been exploited. Please refrain from interacting with the dApp until further notice.

We are looking into the cause of the exploit, and will post a bounty and contact relevant authorities, as well as a post mortem."

"Yet, in a move that would make even the most seasoned poker players sweat, Shezmu called the hacker's bluff.

They laid their cards on the table: return the funds for a 10% bounty and walk away scot-free, or face the full force of the law within 24 hours.

The hacker, unfazed, countered with a demand for 20%.

In a game of crypto chicken, Shezmu blinked first, agreeing to the 20% bounty."

"The Shezmu team is offering a 10% bounty of the exploited funds, provided that the remaining funds are returned within the next 24 hours. If the funds are not refunded within this time frame, we will escalate the matter through legal channels."

"We’ve successfully recovered the remaining funds (minus white hat bounties) and are working on a full post-mortem and recovery plan. Over the next few days, we’ll release details on our plan to ensure Curve, Balancer, and Beefy LPs are made whole.

We would also like to give massive thank you's to both @shoucccc for bringing this to our attention quickly and @ZachXBT who has helped us swiftly locate exchanges tied to wallets, contacted etherscan to flag wallets, and assisting in applying pressure to those who held the funds.

Additionally, we would like to thank our community for supporting us through these troubled times, it means the world to us. Together we will come back stronger, together we are $SHEZMU."

"Over the coming days, here’s what you can expect as part of our comprehensive recovery and reimbursement plan:

1. Snapshot of Impacted LPs: A snapshot of all Beefy, Curve, Balancer, and Aura LPs holding ShezUSD and ShezETH paired assets will be taken to assess the impact and ensure accurate reimbursement.

2. Airdrop of Recovered Funds: Affected LPs will receive an airdrop of the recovered funds from the white hat, which covers over 80% of the lost liquidity. This airdrop will be distributed in the coming days.

3. Debt Tokens to Cover Remaining Losses: To cover the remaining 20% of losses, impacted LPs will be issued debt tokens based on the snapshot. These tokens will represent the outstanding value and will be repaid through protocol fees from interest, bonds, claims, and options executions, as well as treasury and protocol-owned collateral.

4. Balancer ShezETH Pool Recovery Mode: The Balancer ShezETH pool will enter recovery mode once ShezETH is unpaused , enabling proportional withdrawals for LPs, deposits and swaps are disabled in this mode.

5. Following the completion of reimbursements, a full post-mortem and detailed peg restoration plan will be released. This will outline the steps taken to secure the protocol moving forward and ensure the stability of ShezUSD and ShezETH.

We appreciate your continued support and will keep the community updated with each step of the recovery. Our goal is to ensure the safe return of funds and restore confidence in Shezmu."

Shezmu has a series of smart contracts, one of which is a collateralized stablecoin. Due to a vulnerability introduced on September 3rd, it was possible to mint some of these stablecoin units without having actual collateral to back them. This was exploited several times on September 20th, which drained a total of $4.9m worth of liquidity from the protocol. The protocol managed to negotiate with all of the attackers successfully, 10% for most and 20% for one of them. There are plans to rebuild the protocol and restore what was lost.

SlowMist Hacked - SlowMist Zone (Sep 23)
Rekt - Shezmu - Rekt (Sep 23)
@shoucccc Twitter (Sep 23)
0xf68a65993bbd543a03 | Phalcon Explorer (Sep 23)
Shezmu | Leveraging Yield (Sep 23)
Abstract | Shezmu (Sep 23)
@ShezmuTech Twitter (Sep 23)
https://etherscan.io/idm?addresses=0x2604c6b2e0cf38e5ba66b2a5dd93461740d1dbee,0xfaf2484adf637837001404ff95716de1fc3b4331&type=1 (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
@ShezmuTech Twitter (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
@ShezmuTech Twitter (Sep 23)
@ShezmuTech Twitter (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
@ShezmuTech Twitter (Sep 23)
@ShezmuTech Twitter (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
@AnciliaInc Twitter (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
Address 0xfaf2484adf637837001404ff95716de1fc3b4331 | Etherscan  (Sep 23)

More case studies

BingX Massive Hot
Wallet Breach

Compound Finance
Discord Server Phishing