Significant Theft from Voltage Finance
A hacker implicated in a significant theft of $4.67 million from Voltage Finance, a decentralized finance lending protocol, has recently transferred a portion of the stolen Ether to Tornado Cash after a period of inactivity. Blockchain security company CertiK reported on May 6 that approximately 100 Ether, valued at $182,783 based on current market prices, was moved from an address previously linked to the exploit, which is traceable back to the perpetrator.
Details of the Hack
The incident dates back to March 2022 when the hacker exploited a vulnerability in the ERC677 token standard, making use of a built-in callback function that facilitated a reentrancy attack. This exploitation enabled the siphoning off of funds from Voltage Finance’s lending pool. Following the breach, Voltage Finance disclosed that a variety of cryptocurrencies had been stolen, including stablecoins like USDC and Binance USD (BUSD), as well as wrapped Bitcoin and Ethereum tokens.
“The address involved in the recent transaction to Tornado Cash had seen no activity since November, according to data from Etherscan, with its last recorded transaction over five months ago.”
Response Measures
In the aftermath of the 2022 exploit, Voltage Finance took precautionary measures by alerting Etherscan to flag the hacker’s address and requesting that multiple exchanges halt any transactions related to the exploiter. The firm also attempted to engage the hacker in a negotiation for a bounty in hopes of recovering the embezzled assets.
Further Incidents and Recovery Efforts
This wasn’t the last trouble for Voltage Finance; on March 18, the protocol suffered another breach targeting its Simple Staking pools. A total of $322,000 was taken during this incident. In a post-event analysis published on March 20, Voltage Finance stated that they had offered the same hacker a significant bounty of $50,000 for the return of the stolen funds and mentioned a developer suspected of involvement in the staking pools was immediately stripped of access pending further investigation.
April’s Turbulent Landscape
April has been a turbulent month for the cryptocurrency landscape, with overall losses soaring by 1,163%, a trend significantly influenced by a single high-profile theft of 3,520 Bitcoin from the wallet of an elderly individual, totaling around $330.7 million. When excluding that extraordinary incident, total losses for the month still amounted to $34 million—a 21% increase from March. On a brighter note, over $18 million was recovered following various hacks, including the return of all funds stolen from KiloEx just four days post-attack and the recovery of $5 million by the ZKsync Association from a different security breach involving its airdrop distribution contract.
