KEY POINTS
- Crypto security firms alerted the community of a Seneca exploit Wednesday
- Seneca acknowledged there was an "approval bug" on the stablecoin protocol
- The protocol asked its exploiter to return the funds and keep 20% "as per whitehat efforts"
- The hacker returned more than 1,500 ETH worth around $5.3 million Thursday, as per PeckShield
A hacker who gained access to around $6.4 million worth of Ether (ETH) in an exploit of stablecoin protocol Seneca has returned over $5 million after apparently accepting an offer to keep 20% of the stolen funds.
Blockchain security firms CertiK and PeckShield flagged the Seneca exploit Wednesday, warning users about the hack and urging them to revoke approvals from two wallet addresses on the Arbitrum and Ethereum networks.
CertiK's first alert noted that the exploiter took at least $3 million worth of assets. It was later revealed that over 1,900 ETH, worth around $6.4 million, were lost in the exploit. The blockchain monitoring firm explained that the hacker "transferred assets from addresses that had granted approvals to the vulnerable contracts directly to themself."
#CertiKSkynetAlert 🚨
— CertiK Alert (@CertiKAlert) February 28, 2024
We are seeing an exploit on @SenecaUSD
Exploiter has stolen at least ~$3m worth of assets
All users should revoke the following addresses
0xbc83f2711d0749d7454e4a9d53d8594df0377c05
0x2d99e1116e73110b88c468189aa6af8bb4675ec9 pic.twitter.com/iVhDhGwUc8
Seneca confirmed that an "approval bug" was detected Wednesday and it was working "actively" with security specialists to investigate the exploit. It also asked users to revoke approvals for a total of six wallet addresses on Ethereum and Arbitrum.
We are actively working with security specialists to investigate the approval bug found today.
— Seneca (@SenecaUSD) February 28, 2024
In the meantime, REVOKE approvals for the following addresses:#Ethereum
PT-ezETH 0x529eBB6D157dFE5AE2AA7199a6f9E0e9830E6Dc1
apxETH 0xD837321Fc7fabA9af2f37EFFA08d4973A9BaCe34…
On Thursday, Seneca published its on-chain message to the hacker, whom it called "Whitehat." The message asked the exploiter to return the stolen funds, threatening "further legal action." The stablecoin protocol also offered a 20% bounty "as per whitehat efforts."
Dear Whitehat,
— Seneca (@SenecaUSD) February 29, 2024
Please return the funds to the following Ethereum wallet address: 0xb7aF0Aa318706D94469d8d851015F9Aa12D9c53a
We are collaborating with third-party security providers and law enforcement to trace the funds and identify recipient wallets. Acting promptly is… pic.twitter.com/syIQQXHJSQ
Hangzhou-based blockchain security company PeckShield said hours after Seneca's message, the hacker has returned 1,537 ETH, worth around $5.3 million. The exploiter then moved 300 ETH worth around $1.04 million, or about 20% of the total stolen funds, to two new wallet accounts, it added. Seneca has yet to officially confirm the funds' recovery, but CertiK has also posted about the funds being returned.
#PeckShieldAlert @SenecaUSD hacker-labeled address has returned 1,537 $ETH (worth ~$5.3m) to #Seneca: Deployer address & transferred 300 $ETH (~$1.04m) to 2 new addresses pic.twitter.com/hNOFMr1aTk
— PeckShieldAlert (@PeckShieldAlert) February 29, 2024
#CertiKSkynetAlert 🚨
— CertiK Alert (@CertiKAlert) February 29, 2024
The Seneca exploiter has now returned 1,537 ETH (~$5.3m) to the project.
The exploiter kept 300 ETH which was split into 2 new wallets https://t.co/beJTbOAQ3U
The Seneca exploit comes amid continuing hacking incidents in the cryptocurrency industry, one of the biggest being the exploit of nearly $49 million from decentralized exchange (DEX) KyberSwap.
The DEX was hacked late in November, resulting in losses of $48.8 million in digital assets, including some $20 million worth of Wrapped Ether (wETH). Unlike the Seneca exploiter, KyberSwap's hacker was much more difficult to deal with as they even threatened to delay negotiations for fund recovery if the DEX pursued threats of legal action.
Earlier this week, PeckShield reported that the KyberSwap exploiter moved almost $2.5 million worth of ETH from Arbitrum to the Ethereum network. It is unclear if the latest movement of funds is related to the DEX's efforts to the pilfered cryptocurrencies. However, KyberSwap said hours after PeckShield's report that some users who were affected in the November exploit can start claiming their recovered funds.
