ReHold Renat Gafarov Smart Contract Withdrawal
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
ReHold was a smart contract dual investment protocol designed to maximize returns and managed by Michael Semin and Renat Gafarov. On July 15th, 2024, Renat reportedly decided to take $700k from the company funds and prevent Michael from accessing any of the administrative systems or social media accounts. On September 25th, the incident became public, with Michael accused of running away with the money. Within an hour, Michael was public with a more evidence-backed version of events. It appears that all funds lost were related to the protocol itself and not client funds. It appears that clients can use the smart contract through a new website to withdraw their funds.[1][2][3][4][5][6][7][8][9][10]
About Rehold
"ReHold, a new player in the DeFi space, is shaking things up with its Dual Investment protocol. Unlike the traditional staking model, where users receive low to moderate returns over a long period of time, ReHold allows users to bet on cryptocurrencies, including Stablecoins, for 12 or 24 hours at an interest rate of up to 250%."
"Crypto Boost for Everyone Boost your crypto assets with up to 250% APR via Dual Investments"
"Cross-chain protocol uses the best from different blockchains. Easy to use Dual Investment and maximize your profit. OpenZeppelin best practices for smart contracts engineering."
"ReHold is a decentralized company based on smart contracts on BNB Chain. Code is a law (open-source on GitHub), so if you opened a Dual Investment on a specific pool with any amount, you will receive your profit from the smart contract after the staking period ends.
ReHold has public founders with a lot of experience in Fintech, who are always open to discussing users' wishes and complaints.
The largest media Bloomberg, Yahoo Finance, and Benzinga wrote about ReHold. You can easily find these articles by yourself on Google."
About Renat Gafarov
"10+ years in FinTechs, crypto enthusiast since 2017. $750M under management, experienced with big capital and different market strategies."
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
| Date | Event | Description |
|---|---|---|
| March 3rd, 2023 7:09:21 AM MST | Successful Private Launch | According to an investing.com article, rehold has successfully completed the private launch of their dual investment product. |
| July 15th, 2024 12:13:01 PM MDT | Binance Address Whitelist Change | An email reports that the withdrawal address on the whitelist has been changed through Binance. |
| July 15th, 2024 12:15:00 PM MDT | CloudFlare Access Revoked | An email reports that Michael's access to CloudFlare has been revoked. |
| July 15th, 2024 12:17:26 PM MDT | SuperAdmin Access Revoked | Michael's SuperAdmin access is revoked from the Google account. |
| July 15th, 2024 12:18:00 PM MDT | DigitalOcean Unauthorized Sessions | Michael presents "logs from DigitalOcean [which] show multiple unauthorized sessions initiated by Renat from different IPs to withdraw funds from smart contracts and manipulate MPC." |
| July 15th, 2024 3:52:09 PM MDT | Alert Center Viewed | The alert center is viewed, potentially by Michael. |
| July 16th, 2024 12:33:14 AM MDT | Withdrawal From Vault | The first withdrawal transaction from the Rehold vault for 5k USDT is conducted by Renat. |
| July 16th, 2024 2:24:36 PM MDT | Audit And Investigation Query | An audit/investigation query is conducted, likely by Michael to determine how and why his access was removed. |
| September 25th, 2024 4:32:00 PM MDT | Hostile Takeover Notice | The ReHold company posts that their CTO Michael Semin has withdrawn over $700,000 from the company smart contract and his whereabouts are presently unknown. |
| September 25th, 2024 4:56:39 PM MDT | Medium Post Prepared | Michale Semin posts on Medium with an overview walkthrough of the events which happened from his perspective. |
| September 25th, 2024 5:51:00 PM MDT | Michael Semin Update | Michael Semin posts on his personal Twitter account to notify that Renat Gafarov is the one who has actually taken the funds. |
Technical Details
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?
Total Amount Lost
The total amount lost has been estimated at $700,000 USD.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
"On July 15, 2024, @renat_rehold, our co-founder, withdrew over $700,000 from the company’s smart contracts without my approval. We’ve moved to a new domain: https://app.reholdio.com because Renat revoked the team access to the original domain."
"Today, I want to publicly address a serious issue involving my business partner, Renat Gafarov. On July 15th, 2024, Renat withdrew over $700,000 from the protocol’s smart contracts to his wallet (0xcd8e4d644fd8e930b91904e178c625291557a889) without prior agreement from both founders. It was all the company’s net profits and the initial capital provided by both of us.
After transferring the funds, Renat took actions that could be interpreted as an attempt to seize full control of the company, despite our equal 50/50 ownership since the company’s foundation in September 2022. He also frequently failed his duties as CEO, especially in marketing and fundraising matters. He didn’t disclose enough information to the team that the token’s launch (IDO) would not happen because the fundraising process completely failed, as well as negotiations with exchange listings."
Ultimate Outcome
"Client funds and the rest of the company funds are safe. The team has revoked access to smart contracts and other sensitive accounts such as Binance. The protocol is functioning correctly and any user can withdraw his funds at any moment."
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ @rehold_io Twitter (Accessed Oct 28, 2024)
- ↑ @michael_rehold Twitter (Accessed Oct 28, 2024)
- ↑ ReHold Marks Successful Private Launch, Announces Future Plans By Coin Edition (Accessed Oct 28, 2024)
- ↑ ReHold - Crypto Boost for everyone (Accessed Oct 28, 2024)
- ↑ Arkham (Accessed Oct 28, 2024)
- ↑ Arkham (Accessed Oct 28, 2024)
- ↑ $700,000 Unsanctioned Withdrawal by ReHold Co-Founder Renat Gafarov — Full Disclosure and Next Steps | by Michael Semin | Sep, 2024 | Medium (Accessed Oct 28, 2024)
- ↑ @michael_rehold Twitter (Accessed Oct 28, 2024)
- ↑ Important Security Alert | ReHold (Accessed Oct 28, 2024)
- ↑ @rehold_io Twitter (Accessed Oct 28, 2024)