QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$322 000 USD
MARCH 2025
GLOBAL
VOLTAGE FINANCE
DESCRIPTION OF EVENTS
Voltage Finance is a decentralized finance (DeFi) platform that offers a wide range of financial services designed to replace traditional banking through a crypto-powered app. It allows users to trade, invest, and manage digital assets across multiple blockchains with features like gasless swaps, passive income staking, lending, and liquidity provision. The platform is built on the Fuse network, known for its low fees and fast transactions, aiming to make blockchain finance accessible and practical for everyday use.
The app provides a seamless user experience by integrating payments, savings, and investments into one ecosystem. Users can earn yields by staking popular tokens such as ETH, USDC, and FUSE, or by supplying liquidity to pools and earning a share of the transaction fees. Lending services are also available, enabling users to take instant loans backed by their crypto holdings. Additionally, advanced users can leverage tools like liquid staking and trading analytics to optimize returns and gain deeper market insights.
Voltage Finance also focuses on real-world usability. Through the Volt Visa card, users can spend their crypto in over 180 countries at more than 80 million merchants, earning up to 2% cashback on purchases. The app supports stablecoin transfers, global remittances, and on/off ramping, allowing users to move between fiat and crypto with ease. A unique points system rewards users for interactions such as swapping, staking, and referring others, which can be redeemed for benefits within the platform.
Security is a core feature of Voltage Finance. It uses advanced on-chain infrastructure and Safe technology to secure user funds without relying on traditional seed phrases, instead offering biometric protection and self-custody. Altogether, Voltage Finance combines the best of DeFi with user-centric design to deliver a secure, rewarding, and comprehensive financial experience.
"Step 1: The exploit began when an unknown party (Attacker 2) withdrew ETH from HTX (see tx). Step 2: Attacker 2 funded Attacker 1 (see tx). Step 3: Attacker 1 purchased FUSE tokens from ChangeNow (see tx). Step 4: Tokens were bridged to Fuse Network via Layerzero (see tx). Step 5: The attacker compromised the SimpleChefStaking proxy address, changing it to a malicious implementation (see tx). Step 6: Funds were drained via the forceWithdraw function (see tx). Step 7: Proxy was immediately reverted to its original state (see tx). Step 8: Attacker bridged stolen funds to Ethereum (USDC tx, WETH tx). Step 9: Funds moved from Attacker 1 to Attacker 3 (see tx). Step 10: Attacker 3 received funding via SimpleSwap (see tx). Step 11: Funds deposited to KuCoin (see tx). Step 12: Attacker swapped USDC and withdrew to Attacker 1 (see tx)."
In total, $171,027.20 in USDCE and $151,085.87 in WETH were stolen.
The Voltage Finance team reacted immediately by revoking access from the developer responsible for the compromised Simple Staking contract, after identifying suspicious behavior. Though it was not confirmed that the developer was the attacker, they took precautionary action and filed police reports to work with law enforcement and centralized exchanges.
Voltage Finance confirmed that all other contracts remain secure under multisig safes and no additional user funds were affected. Their main focus is recovering the stolen assets, offering a $50,000 bounty to the attacker for full restitution. They plan to strengthen platform security through enhanced audits, community testing, expanded bug bounty programs, and improved hiring practices with third-party background checks.
Affected users are encouraged to complete an impact assessment form to assist in developing appropriate resolutions. Voltage Finance is still attempting to retrieve the stolen funds by offering a $50,000 bounty to the attacker. There is an investigation into a developer suspected of involvement. Voltage is in the process of enhancing its security measures, such as audits, bug bounties, and hiring practices.
Voltage Finance is a decentralized finance platform that provides a wide range of services, including gasless swaps, staking, lending, and liquidity provision, all built on the Fuse network. Users can earn passive income, access instant loans, and spend crypto globally using the Volt Visa card. However, the platform was recently hacked, with $322,000 stolen from its Simple Staking contract. Voltage Finance reacted by revoking access from a developer linked to the compromised contract, filing police reports, and working with law enforcement. They are offering a $50,000 bounty to recover the stolen funds and are strengthening security with enhanced audits, bug bounties, and third-party background checks. Users are encouraged to fill out an impact assessment form to stay up to date.
Voltage Finance Transparency Post Mortem Report: Simple Staking Hack | by Voltage Finance | Mar, 2025 | Medium (May 9)
Unknown Party Withdraws ETH from HTX - Etherscan (May 9)
