Originally published on: September 16, 2024
In a bold move, a hacker managed to siphon over $6 million from the decentralized finance (DeFi) platform Delta Prime by minting an astonishing number of deposit receipt tokens.
The attack, uncovered through data from the block explorer Arbiscan, saw the cybercriminal create more than 115 duovigintillion Delta Prime USD (DPUSDC) tokens during the initial breach. To put this figure into perspective, that’s over 1.1*10^69 in scientific notation.
These DPUSDC tokens represent deposit slips for the stablecoin USDC, valued at $1.00 each, held within Delta Prime. The intention is for these tokens to be redeemed at a 1:1 ratio for USDC.
Despite this massive minting maneuver, the attacker only converted 2.4 million tokens into $2.4 million worth of USDC stablecoin.
The attacker then went on to repeat this process for other deposit receipt tokens, such as Delta Prime Wrapped Bitcoin (DPBTCb), Delta Prime Wrapped Ether (DPWETH), and Delta Prime Arbitrum (DPARB), minting staggering amounts of each. In the end, the attacker redeemed a fraction of the minted tokens, collecting over $1 million in Bitcoin, Ether, Arbitrum, and other tokens.
According to blockchain security expert Chaofan Shou, the attacker has made off with an estimated $6 million in ill-gotten funds so far.
This brazen act was made possible after the hacker gained control of an admin account ending in b1afb, potentially by absconding with the developer’s private key. Deploying an “upgrade” function typically reserved for software updates, the attacker redirected each liquidity pool contract to a malicious contract they had created, enabling them to mint an unlimited amount of deposit receipts and deplete the funds from each pool.
Delta Prime has since confirmed the attack, stating, “At 6:14 AM CET DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M.” They assured users that the Avalanche version, Delta Prime Blue, is not susceptible to the exploit and that the protocol’s insurance would cover any potential losses.
The breach underscores the risks faced by DeFi platforms utilizing upgradeable contracts. While the Web3 ecosystem is fortified against private key hacks that could compromise entire protocols, the ability to upgrade contracts introduces a centralization risk, leaving users vulnerable to fund depletion.
As debates within the Web3 community continue regarding the conditions under which protocols should allow upgrades, the recent Delta Prime attack serves as a stark reminder of the pitfalls and perils lurking in the world of decentralized finance.
