The Multichain MPC bridge platform has seen abnormally large outflows, fueling concerns that the platform could be a target for a multi-million dollar exploit.
According to the available information, over $130 million worth of crypto has been moved out from the bridge platform.
Huge Outflows From Multichain
The outflows first came to light on the 6th of July, when observers noticed that $102 million worth of crypto was withdrawn from the Multichain Fantom bridge on the Ethereum side. Additionally, $666,000 worth of Dogecoin and $5 million from Moonriver were also withdrawn. Additionally, 7214 Wrapped Ether (WETH) tokens worth $13.6 million, 1024 Wrapped Bitcoin (WBTC) worth $31 million, and $58 million worth of the USDC stablecoin were withdrawn from the Fantom bridge’s Ethereum smart contract. The total value of the cryptocurrency removed by the end of the day stood at over $100 million.
Additionally, the Dogecoin bridge’s Ethereum contract saw a withdrawal of around $666,000, which accounts for over 86% of its total deposits. As a result, the bridge currently has only around $100,000 worth of assets remaining. Over $5.8 million worth of USDT and USDC were also withdrawn from the Multichain Moonriver contracts on Ethereum, with the Moonriver bridge contracts now having only around $700,000 remaining on them.
Possible Exploit?
Several on-chain investigators took to Twitter to warn the community that the event could be a possible exploit. Curve Finance was among the first to warn users that Multichain was, in all probability, hacked and that they should revoke all approvals.
“Multichain likely hacked. Exit all multichain assets. Good idea to revoke approvals to multichain bridge if you had any.”
Blockchain security firm PeckShield tagged Multichain in a Twitter post, highlighting the Phantom chain transactions and urging the team to take a closer look. Another commentator remarked that the entire fiasco looked like another massive hack, while On-chain investigator Spreek posted the Dogecoin transactions, urging the team to look at the transactions. However, Multichain did not respond to the tweets in question. Meanwhile, Fantom Foundation CEO Michael Kong stated that the Fantom team was looking into the issue.
Multichain Finally Responds
Multichain finally responded to users in a later tweet, stating that the movement of funds was indeed abnormal, and the team was “unsure of what was happening and is currently investigating the issue.” Multichain stated on Twitter,
“The lockup assets on the Multichain MPC address have been moved to an unknown address abnormally. The team is not sure what happened and is currently investigating. It is recommended that all users suspend the use of Multichain services and revoke all contract approvals related to Multichain.”
Multichain’s Growing Issues
Multichain is a multi-party computation (MPC) bridging network, enabling users to bridge assets between chains. When a user wishes to bridge an asset, Multichain first confirms if the assets have been locked on the first chain. Once confirmed, the network mints the derivative assets on the second chain. When a user wishes to make a withdrawal, the process repeats itself, but in reverse. It will first confirm if the derivative assets have been destroyed on the second chain before releasing the locked assets back on the first chain.
Multichain’s team claims that the cryptographic keys controlling the entire process are split into shards and then distributed throughout the network. This should, theoretically, prevent any entity from making unauthorized withdrawals.
However, Multichain has been in the news for all the wrong reasons after suffering unspecified technical problems over the past few weeks. The team announced on the 31st of May that the CEO had gone missing, with the network suffering a multitude of problems due to unforeseeable circumstances, leading to significant transaction delays. Binance also announced that it was halting the withdrawal of some Multichain derivative tokens due to network issues on Multichain.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
Credit: Source link
