Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/deltaprimearbitrumprivatekeyleaked.php}} {{Unattributed Sources}} DeltaPrime Logo/HomepageDeltaPrime is a decentralized lending platform which aims to be more capital efficient, but still fully collateralized. Unfortunately it appears that they hired some developers who were actually from North Korea, and this may have resulted in a back door in their syste..."

2024-09-17T17:20:42Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/deltaprimearbitrumprivatekeyleaked.php}} {{Unattributed Sources}} thumb|DeltaPrime Logo/HomepageDeltaPrime is a decentralized lending platform which aims to be more capital efficient, but still fully collateralized. Unfortunately it appears that they hired some developers who were actually from North Korea, and this may have resulted in a back door in their syste..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/deltaprimearbitrumprivatekeyleaked.php}}
{{Unattributed Sources}}

[[File:Deltaprime.jpg|thumb|DeltaPrime Logo/Homepage]]DeltaPrime is a decentralized lending platform which aims to be more capital efficient, but still fully collateralized. Unfortunately it appears that they hired some developers who were actually from North Korea, and this may have resulted in a back door in their systems. This was likely later used to gain access to the private key for their Arbitrum smart contracts. The key was used to upgrade and drain the smart contracts of $5.98m worth of assets. Assets were quickly converted to Ethereum and laundered. The protocol has reported that their insurance fund will cover all losses.<ref name="rektnews-15438" /><ref name="deltaprimedefitwitter-15439" /><ref name="arbiscan-15440" /><ref name="arbiscan-15441" /><ref name="arbiscan-15442" /><ref name="hackenclubtwitter-15443" /><ref name="deltaprimelabsgithub-15444" /><ref name="cyversalertstwitter-15445" /><ref name="zachxbttwitter-15446" /><ref name="zachxbttwitter-15447" /><ref name="shoucccctwitter-15448" /><ref name="ruggedbyphonetwitter-15449" /><ref name="deltaprime-15051" /><ref name="deltaprimedocs-15052" />

== About DeltaPrime ==
"Be The Whale. Your trustless, transparent, prime brokerage on Avalanche and Arbitrum. Deposit and securely earn high APYs. Borrow up to 5x your collateral, explore intuitive investment strategies and unlock your capital's full potential."

"Unlock the full potential of your capital with the Prime Account: an empowered, escrow smart contract, just for you."

"Traditional lending systems like banks rely on trust and credit checks to ensure loan repayment. When that trust is broken, everyone feels it." "Trustless lending platforms like Aave / Radiant rely on locking high amounts of collateral to ensure loan repayment. This locked liquidity is trapped, harming the chain the platform is in."

"Prime Brokerage solutions (read: DeltaPrime) rely on keeping access to borrowed funds to ensure loan repayment. While a borrower can use and profit from their collateral and borrowed funds to use in other DeFi platforms, funds are always accessible by an automated escrow smart contract. This ensures trustless loan repayment, without the need for credit checks."

== The Reality ==
"Idk if related but they were one of the teams with the DPRK IT workers I reached out to warn (was told they were all removed)"

== What Happened ==
"DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M." "a total of 57 withdrawals were executed."
{| class="wikitable"
|+Key Event Timeline - DeltaPrime Arbitrum Private Key Leaked
!Date
!Event
!Description
|-
|August 15th, 2024 5:36:00 AM MDT
|ZachXBT Notes DPRK Developers
|ZachXBT posts a list of fake DPRK developers which have been working at different projects, including one which is drained for $1.3m from their treasury.
|-
|September 15th, 2024 10:02:46 PM MDT
|Gas Funding Transaction
|The malicious actor funs their account with 0.19 ETH to be used in the attack.
|-
|September 15th, 2024 10:14:02 PM MDT
|First Malicious Contract Upgrade
|The very first transaction happens to upgrade a smart contract.
|-
|September 15th, 2024 10:14:08 PM MDT
|First Malicious Withdrawal
|Barely seconds later, withdrawal from the first smart contract would start.
|-
|September 15th, 2024 11:41:00 PM MDT
|Chaofan Shou Tweet
|Chaofan Shou tweets, reporting that all pools are drained because the "admin private key leaked" and the loss amount is $7m so far.
|-
|September 16th, 2024 12:15:00 AM MDT
|ZachXBT Notes DPRK Involvement
|ZachXBT notes that the DeltaPrime project was on his list of projects which had hired fake DPRK workers.
|-
|September 16th, 2024 12:32:56 AM MDT
|Proxy Admin Change Over
|The Proxy Admin is changed for all smart contract involved, removing the ability for further modifications to be made.
|-
|September 16th, 2024 12:36:00 AM MDT
|Cyvers Alert Posted
|The Cyvers team posts an alert of the DeltaPrime smart contracts, correctly noting the incident is caused by a leaked private key. Total losses at this point are announced to be $4.5m, and the Cyvers team notes the potential for this total to increase.
|-
|September 16th, 2024 2:55:00 AM MDT
|Announcement Of Breach
|An announcement is posted on Twitter to highlight the breached private key. Accordingly, the Arbitrum version of the smart contract was drainged for $5.98m, while the Avalanche version was not.
|}

== Technical Details ==
"In a dizzying display of greed (or thoroughness, depending on your perspective), a total of 57 withdrawals were executed.

The grand finale came with the attacker riding off into the sunrise with their ill-gotten gains.

The loot bag? A mix of USDC, WBTC, and WETH – all swiftly swapped to ETH."

== Total Amount Lost ==
"At 6:14 AM CET DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M."

The total amount lost has been estimated at $5,980,000 USD.

== Immediate Reactions ==

"ALERT Our system has detected multiple suspicious transactions involving @DeltaPrimeDefi on $ARB chain! (Still ongoing)

It seems that admin has lost the private key. Suspicious address still draining the pools! Affected pools so far are the #DPUSDC, #DPARB, #DPBTCb ! Suspicious address already swapped $USDC to $ETH!

Total estimated loss is around $4.5M so far! however, suspicious address still draining the pools! Total loss might increase!"

"At 6:14 AM CET DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M. This was due to a compromised private key, the source of which is currently under investigation.

DeltaPrime Red (Avalanche) is not vulnerable to this attack, as the implementation here is covered solely by multisigs and cold wallets (as it should be)."

== Ultimate Outcome ==
"The risk is contained, we're working on asset-retrieval and the insurance pool will cover any potential losses where possible / necessary. Additionally, we're looking into other ways to reduce user losses to a minimum."

== Total Amount Recovered ==
"The risk is contained, we're working on asset-retrieval and the insurance pool will cover any potential losses where possible / necessary. Additionally, we're looking into other ways to reduce user losses to a minimum."

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
"We will keep you updated here as well as in our Discord as we move forward."
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-15438">[https://rekt.news/deltaprime-rekt/ Rekt - DeltaPrime - Rekt] (Accessed Sep 17, 2024)</ref>

<ref name="deltaprimedefitwitter-15439">[https://twitter.com/DeltaPrimeDefi/status/1835603279369125893 @DeltaPrimeDefi Twitter] (Accessed Sep 17, 2024)</ref>

<ref name="arbiscan-15440">[https://arbiscan.io/tx/0xeb034ecfa6b1eaa95bc659883eff8a106fd5d7262da54848525f656597f55d3f Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Sep 17, 2024)</ref>

<ref name="arbiscan-15441">[https://arbiscan.io/tx/0x2e6748e92e4f833d3ea3c2aa7d11e74aa502e2cfcab8398dc2056a83a1b7caae Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Sep 17, 2024)</ref>

<ref name="arbiscan-15442">[https://arbiscan.io/tx/0x28a9b62fbfc375ebb3f5321d80baac9c2a225a6ec2f140cbfae5bff95fc80b1e Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One] (Accessed Sep 17, 2024)</ref>

<ref name="hackenclubtwitter-15443">[https://twitter.com/hackenclub/status/1835582831952597270 @hackenclub Twitter] (Accessed Sep 17, 2024)</ref>

<ref name="deltaprimelabsgithub-15444">[https://github.com/DeltaPrimeLabs/deltaprime-primeloans/tree/dev/main/audits deltaprime-primeloans/audits at dev/main · DeltaPrimeLabs/deltaprime-primeloans · GitHub] (Accessed Sep 17, 2024)</ref>

<ref name="cyversalertstwitter-15445">[https://twitter.com/CyversAlerts/status/1835568466901766208 @CyversAlerts Twitter] (Accessed Sep 17, 2024)</ref>

<ref name="zachxbttwitter-15446">[https://twitter.com/zachxbt/status/1824047425822310580 @zachxbt Twitter] (Accessed Sep 17, 2024)</ref>

<ref name="zachxbttwitter-15447">[https://twitter.com/zachxbt/status/1835563015694917831 @zachxbt Twitter] (Accessed Sep 17, 2024)</ref>

<ref name="shoucccctwitter-15448">[https://twitter.com/shoucccc/status/1835554652777336975 @shoucccc Twitter] (Accessed Sep 17, 2024)</ref>

<ref name="ruggedbyphonetwitter-15449">[https://twitter.com/RuggedByPhone/status/1835647703910343057 @RuggedByPhone Twitter] (Accessed Sep 17, 2024)</ref>

<ref name="deltaprime-15051">[https://deltaprime.io/ DeltaPrime] (Accessed Aug 20, 2024)</ref>

<ref name="deltaprimedocs-15052">[https://docs.deltaprime.io/ Unlock the Blockchain | DeltaPrime] (Accessed Aug 20, 2024)</ref></references>

DeltaPrime Arbitrum Private Key Leaked - Revision history