Badger DAO Appears to Have Lost Over USD 120M in an Attack

Altcoins DAO DeFi Hack

Author

Ruholamin Haqshanas

Author

Ruholamin Haqshanas

About Author

Ruholamin Haqshanas is a contributing crypto writer for CryptoNews. He is a crypto and finance journalist with over four years of experience. Ruholamin has been featured in several high-profile crypto...

Author Profile

Share

Copied

Last updated: 

October 22, 2023

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Badger DAO, a decentralized autonomous organization (DAO) that enables bitcoin (BTC) to be used as collateral across decentralized finance (DeFi) applications, has fallen victim to an exploit. 

It was originally speculated that the project has lost over USD 10m worth of cryptoassets. However, Etherescan transactions suggest that one of the affected users has lost around 897 WBTC (wrapped BTC) (USD 51m), implying that the hack is much bigger than initially thought.

Furthermore, Etherescan transactions show that the hacker has taken WBTC 1,085), 136,000 cvxCRV (Convex CRV), 64,000 veCVX, and other forms of vaulted and synthetic crypto assets from users wallets – pushing the amount stollen over USD 62m. 

Here is the list of funds that were so far transferred out from victims @BadgerDAO pic.twitter.com/P5pOj1YQ2l

— PeckShield Inc. (@peckshield) December 2, 2021

However, upon further research, blockchain analytics and security firm PeckShield argued that the total amount lost in this hack is a whopping USD 120.29m. This includes a significant amount of bitcoin and ethereum: BTC 2,100 and ETH 151, per their calculations.The company also provided a list of addresses as the stolen funds’ “current whereabouts.”

BadgerDAO has not denied or confirmed this information by the time of writing. Per their latest updates, they are continuing the investigation. 

“Badger has retained data forensics experts Chainalysis to explore the full scale of the incident & authorities in both the US & Canada have been informed & Badger is cooperating fully with external investigations as well as proceeding with its own,” said a tweet.

Meanwhile, per some Twitter users, as well as those on Reddit, the one person/entity that lost nearly 897 Badger WBTC – currently worth USD 50.39m – to the exploiter was none other than Celsius Network (CEL). The reason behind the conclusion that “this address is owned by Celsius” is that “it has interacted with other addresses known to be owned by them.” The users continued to provide a list of addresses that are allegedly connected to Celsius and have interacted with each other – but the Redditor also emphasized that this is just speculation.

Cryptonews.com has reached out to Celsius for a comment.

On Thursday, the Badger team has confirmed the hack, saying that they have “received reports of unauthorized withdrawals” of user funds, and that smart contracts have been paused to stop withdrawals.

Badger has received reports of unauthorized withdrawals of user funds.

As Badger engineers investigate this, all smart contracts have been paused to prevent further withdrawals.

Our investigation is ongoing and we will release further information as soon as possible.

— ₿adger 🦡 (@BadgerDAO) December 2, 2021

Meanwhile, some users speculate that the attacker has been “sneaking in approvals in between legit deposit and reward transactions,” stealing funds for approximately 12 days, adding that it could be a so-called rug pull, when developers abandon a project and run away with investors’ funds.

https://www.twitter.com/napgener/status/1466255608823357452

However, Badger core contributor Tritium said on Discord that some users might have approved the exploit address to operate on their vault funds. “It looks like a bunch of users had approvals set for the exploit address allowing [the address] to operate on their vault funds and that was exploited,” Tritium said.

“Once we noticed we froze all the vaults so nothing can move and are trying to figure out where the approvals came from, how many people have them, and what next steps are,” Tritium added.

____

Learn more:
– MonoX Team Confirms Exploit, USD 30M+ Might Be Stolen
– AnubisDAO Points at ‘Critical Mistake’ After Losing USD 60M of Investors Money

– Cream Finance Suffers Another Exploit as Attacker Runs Away With USD 100M+
– Vee Finance Reports an USD 36M Exploit, VEE Takes a Dive

– SushiSwap’s MISO Suffers USD 3M Attack, Contract Thefts May Rise
– A Tale of Two Hacks: Poly Hacker Bows Out, Liquid to Restore Operations

___
(Updated on December 3, at 15:46 UTC with additional details and comments.)