BSC-Based Uranium Finance Attacked, Millions on the Move
Decentralized finance (DeFi) project on Binance Smart Chain (BSC), Uranium Finance, reported that it has suffered a security breach – with millions of dollars in ethereum (ETH) on the move and laundered through a popular privacy tool.
“Uranium migration has been exploited, the following address has 50m in it,” tweeted the project today. “The only thing that matters is keeping the funds on BSC, everyone please start tweeting this address to Binance immediately asking them to stop transfers.”
The contract currently shows 0 binance coin (BNB), as well as nearly 18m binance USD (BUSD) and 34,186 wrapped BNB (WBNB) – USD 37m in total.
An address allegedly involved in the hack currently holds USD 92,604 in ETH and DAI 2,581. In the last three hours, the ‘Uranium Finance Hacker’ has been moving the funds out in batches of ETH 100, 22 times so far, through the privacy-focused wallet Tornado Cash. In total, this address shows that ETH 2,201 has been moved so far, currently worth nearly USD 5.76m.
The team additionally said that they are in contact with Binance Security Team and “in the process of escalating this,” adding to those in possession of the funds or those who know someone who is, to contact them “to arrange a deal before this goes higher.”
What allegedly happened is hackers taking over the migration of Uranium’s liquidity provider (LP) tokens.
Some also argue that the issue was a bug exploited by the attacker.
MyCrypto.com noted that, per a Telegram group member, “funds migrated to contract > funds laundered off of BSC > funds moved to ETH and to BTC.”
Commenters are calling out the project, claiming that this is the second security incident they have faced, and that it’s giving a bad name to BSC.
Earlier in April, the team said that they’ve learned from their “missteps in V1, and have made the security and reliability of both our contracts and web infrastructure our highest priority.”
And there are also accusations of a potential exit scam.
Finally, with Tornado Cash being used, some argue that there is nothing more to be done about the stolen funds.
This incident is still developing.
___
Other reactions:
__
____
Learn more:
– Binance Chain is On ‘a Parabola’, Surpassing Ethereum in Several Metrics
– Another DeFi Hack: PancakeSwap, Cream Finance Websites Compromised
– Hack Sunday: NFT Theft Follows a Personal Token Attack
– Crypto Security in 2021: More Threats Against DeFi and Individual Users
– PAID Crashes on Alleged Massive Exploit News
– Top 4 Risks DeFi Investors Face
