TopGoal Hot Wallet Breach

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

TopGoal

TopGoal is a system of NFT collectibles featuring historic moments of football/soccer. One of the hot wallets for the TMT token was breached through an undisclosed means, and 4,809,984 TMT was taken, liquidated for 2,600 BNB. The funds were mixed through TornadoCash. The original tokens were all belonging to the founding team. An equivalent number of TMT tokens were withdrawn from the liquidity pool to restore the original token price.

This is a global/international case not involving a specific country.

About TopGoal

"TopGoal is an officially licensed digital collectibles with NFT and blockchain empowered GameFi of football metaverse. We partner world famous football players, clubs as well as institutions to allow fans to collect legendary football player cards only owned by you, build your fantasy squad and participate in the football game of players from all over the world!"

"TopGoal team truly believes in the future of crypto and the potential of bridging sports to crypto through NFT and Gaming. The team has also committed lots of effort and resources to the project."

"Today TopGoal operation hot wallet was attacked and compromised." "Hot wallets operated by TopGoal were attacked and compromised. In this hack, only the hot wallet operated by TopGoal, which manages the distribution of TopPrize rewards, was affected. All user assets including NFTs and TMTs are safe." "Our tech team has been investigating this issue and collaborating with BNB chain (previously known as BSC) to rule out future attacks."

"TopGoal’s tech team has confirmed the hacker attacked the TopGoal’s service to distribute TMT rewards of TopPrize event. All users’ wallets and assets on the platform have not been attacked. The tech team has been working on enhancing the security of the whole platform service to prevent future hacking events. The team is also collaborating with industry partners to track down the hacker."

"The liquidity pool attacked by the hacker on PancakeSwap was 100% contributed by the TopGoal team initially with $1 million self fund." "TopGoal team has suspended the platform service temporarily in order to protect users' assets as soon as the attack was identified."

"The hackers transferred a total of 4,809,984 TMT from the TopGoal-operated hot wallet to the[ir] address. The hackers then exchanged all those TMTs from PancakeSwap for over 2,600 BNB and used Tornado to transfer the BNB out of the address."

"The services of TopGoal website have been resumed now. Users can deposit and withdraw TMT or stable coins. If you have requested withdrawal during the temporary suspension, the funds are returned to your TopGoal account."

"The team has been working with BNB Chain, BSCScan, PeckShield, Certik and other related partners to solve this issue and resolve the unnecessary misunderstanding and concerns among its community." "The tech team has been working on improving the security of the operation hot wallet to make sure attacks are prevented in the future

"[I]n order to mitigate the negative impact on TMT price, the team has decided to rebalance the entire liquidity pools on PancakeSwap, BiSwap and Mars to restore the stability of the TMT-BUSD price. TMT tokens equal to the amount (4,809,984) compromised through this attack will be withdrawn from the pools. All the BUSDs remain in the liquidity pools."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - TopGoal Hot Wallet Breach
Date	Event	Description
February 16th, 2022 8:12:00 AM	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost has been estimated at $1,113,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?