In a dramatic twist, one of this week’s Multichain hackers has returned 322 ETH ($974,000 at the time of writing) to the cross-chain routing protocol and one of the affected users.
But nevertheless, the hacker kept 62 ETH ($187,000) as a “bug bounty”, pending a total of 528 ETH (worth $1.6 million) after the exploits.
Earlier this week, news of a security vulnerability in Multichain emerged. related to WETH, PERI, OMT, WBNB, MATIC, and AVAX tokens, and $1.43 million was stolen. multi-chain advertisement on January 17 that the critical vulnerability had been “reported and fixed”.
However, publicity about the vulnerability apparently encouraged several attackers to go on the attack, and more than $3 million in funds were stolen. The critical vulnerability in all six tokens still exists, but Multichain has drained around $44.5 million of funds from multiple chain bridges to protect them.
Yeah, bridge contract need pause function. https://t.co/lPjLsE5EtR
— Zhaojun (@zhaojun_sh) January 20, 2022
Yes, the bridge contract needs the pause function.
One of the hackers, who calls himself a “white-hat”, has been in communication with both Multichain and a user who lost $960,000 on the last day or so to negotiate 80% of the money back in exchange for a hefty finding fee.
According to a Tweet on January 20 from ZenGo wallet co-founder Tal Be’ery the hacker claimed that he had been “saving the rest” of the Multichain users who were being attacked by bots, in an act of defensive hacking.
The funds were returned in four transactions. On January 20, the hacker returned 269 ETH ($813,000) in two transactions directly to the user he had stolen it from, keeping a 50 ETH ($150,000) reward for himself.
The relieved user replied to the hacker:
“Well received, thank you for your honesty.”
From overnight, the hacker also returned 50 ETH ($150,000) in two transactions to the official Multichain address, keeping a “bug bounty” of 12 ETH ($36,000).
Multichain (formerly Anyswap) claims to be the “ultimate router for Web3”. The platform supports 30 chains at the moment, including Bitcoin (BTC), Ethereum (ETH), Avalanche (AVAX), Litecoin (LTC), Terra (LUNA), and Fantom (FTM).
In a Tweet from January 20, Multichain co-founder and CEO Zhaojun admitted that Multichain bridging contracts need a pause function to deal with similar incidents in the future.
Cointelegraph has contacted the project for comment.
Keep reading: