This weekly roundup of news from Mainland China, Taiwan, and Hong Kong attempts to curate the industry’s most important news, including influential projects, changes in the regulatory landscape, and enterprise blockchain integrations.
Could green miners get a pass?
Last week’s column had a look at the recent crackdown on cryptocurrency miners as China heads towards a more carbon-neutral policy. This week, the Southwest province of China was humming a slightly different tune as the Sichuan Energy Regulatory Office organized a symposium on the topic. The province has a heavy mining concentration due to low cost energy generated from a developed hydroelectric power system. The symposium failed to reach a resolution, leading to speculation that the green energy of the province will lead to much more positive regulation.
Zhang Nangeng, CEO of mining-machine manufacturer Canaan, added to this speculation by calling for China to make allowances for green-energy powered miners. “For-profit miners prefer regions with low electricity prices that indicate oversupply, and likely energy waste. Bitcoin miners also help create jobs in impoverished regions and contribute to fiscal coffers,” pointed out the CEO. It seems unlikely that China will continue to allow miners to abuse coal-powered electricity in regions like Inner Mongolia, but for Sichuan there is definitely an argument to be made in favor of the lucrative mining industry.
Uniswap rug pulls on state-run TV
On June 2, national television channel CCTV-13 reported on virtual currency fraud in their News Room segment. In the report, they introduced how a virtual currency TRTC was listed on Uniswap before having all the liquidity removed. Blockchain smart contract auditor SlowMist was also featured as they demonstrated how the fraudulent activity was conducted. In the TRTC case, 59 ETH were removed from the pools, worth about $100,000. CCTV-13 concluded by warning about the risks of financial fraud on cryptocurrency platforms such as Uniswap. On Twitter, Uniswap founder Hayden Adams mistakenly tweeted about the segment, confusing the video clip as a positive report. Apparently Adams hasn’t spent as much time practicing his mandarin as other early Ethereum pioneers Vitalik Buterin and Gavin Wood, who both have a decent grasp of the language.
BS and C?
In a Chinese-language interview on May 29, Binance founder CZ distanced himself further from Binance Smart Chain by claiming that it has no control over the chain and that it was not responsible for the creation of it. He coyly suggested that BSC has been a community project and that he rarely speaks to the team behind it. Binance and competing Chinese exchanges may be rethinking their positioning after a series of hacks and exploits have haunted the various ‘smart chains’ that offer further utility to exchange tokens and their users.
Blockchain, not Bitcoin
Despite the increasingly harsh regulatory environment, China hasn’t backed down on its pro-technology stance. On May 31, new blockchain technician standards were released from the Ministry of Human Resources and Social Security and the Ministry of Industry and Information Technology. The standards detailed what skills and core competencies are required to work in the industry.
$6.2 million CBDC airdrop
Beijing is launching another digital yuan lottery as it continues to push the release of the central bank digital currency. The Beijing Local Financial Supervision and Administration announced on June 2 that the government will distribute the free currency to citizens who apply before June 7. This comes in the same week that former People’s Bank of China director Yao Qian stated that the digital yuan was not to be used as a surveillance tool. He claimed the technology was initially developed to counter the private sector’s control of the payment sector. The western world might remain skeptical on this point but the need to balance the private sector is certainly plausible, given the national dominance of Alipay and WeChat pay.
Impossible Finance, a Defi protocol built on Binance Smart Chain, has completed a $7 million seed funding round backed by over 125 institutional and angel investors — with the funds going towards the development of a multi chain DeFi incubator.
The seed round was led by venture capital firm True Ventures, and quantitative investment firm Alameda Research, blockchain development firm Hashed and investment firm CMS Holdings.
Impossible Finance was launched on BSC on April 9, and the protocol currently offers DeFi investors token swaps, liquidity pools, and staking rewards through the Impossible Finance (IF) token
The new funding will go towards development of a multi-chain ecosystem for the project, which plans to expand to support to Ethereum and Polygon, along with deployments on layer-two (L2) solutions and other platforms in the future.
As part of the multi-chain ecosystem, Impossible is also developing an automated market maker (AMM) liquidity protocol, which will act as the backbone for a decentralized incubator and launch pad for new DeFi projects. And of course, it will launch the related Impossible Decentralized Incubator Access (IDIA) token.
Plans to expand support to Ethereum and Polygon are timely in light of a wave of recent exploits on the BSC, including a growing list of rug pulls and hacks. It raises the question of whether hacks and exploits are somehow endemic to how the platform operates, or just part of its growing pains?
In recent weeks, DeFi protocol BurgerSwap was drained of $7.2 million in a flash loan attack, along with yield protocol Belt Finance, which lost $6.3 million after a hacker exploited a flaw in the protocol’s vault.
PancakeBunny suffered a $200 million flash loan attack from a hacker who borrowed a “huge amount” of Binance Coin (BNB), and then proceeded to manipulate BUNNY’s price and dump it all and completely tank the price of the asset. Spartan Protocol was also drained off $30 million in a coordinated attack on its liquidity pool.
Earlier this year, users of yield vault project Meerkat Finance lost $31 million on the platform due to an alleged rug pull by the developers. Uranium Finance, an AMM platform built on the BSC was subject to a hack — with the hacker reportedly swooping in to exploit a bug in Uranium’s balance modifier logic and stealing $50 million in the process.
Belt Finance has become the latest Binance Smart Chain-based decentralized finance, or DeFi, protocol to lose millions to an opportunistic hacker.
The Rekt Blog, which post mortems DeFi exploits, stated that an attacker exploited a flaw in the way the protocol’s vaults calculates the value of its collateral which helped to “add another notch to the now infamous flash loan exploit season on the BSC,” adding:
“Yet another fork of a fork has rolled off the conveyor belt with $6.3M falling straight into the hands of the hacker.”
Rekt revealed that a total of eight flash loans were made on PancakeSwap for $385 million BUSD. The beltBUSD vault’s “Elipsis” strategy was exploited as it was the most undersubscribed strategy on the platform.
Belt Finance uses an optimal yield aggregator to offer passive yield generation to depositors. Elipsis is a decentralized exchange that enables swapping of stablecoins with low slippage on the Binance Smart Chain. The beltUSD vault also deploys capital on the BSC-based protocols Venus, Alpaca, and Fortube for yield generation.
On May 30, SushiSwap core developer Mudit Gupta posted a Twitter thread examining the incident, describing the flash loan attack as one of the “more complex hacks.”
Belt’s vaults operate with a target balance for each strategy employed, he explained. When a user deposits money into a vault, the capital is allocated to the most undersubscribed strategy. When someone withdraws money from the vault, it withdraws it from the most oversubscribed strategy.
Gupta asserted the attacker exploited this system to make several transactions across multiple strategies, inflating the value of its pools before repaying the flash loan and pocketing more than $6 million in profits. Gupta concluded:
“Basically, the issue happened because Belt incorrectly integrated with Elipsis. A similar issue happened last month as well in belt finance but at that time, the problem was a buggy integration with Venus. I wonder if belt has any bug-free integration.”
Venus is another BSC protocol for lending and borrowing via the minting of synthetic stablecoins.
Belt Finance is the latest in a lengthening list of BSC DeFi protocols to get exploited. On May 28, the BurgerSwap DEX was attacked resulting in the draining of $7.2 million.
So far this year, Cream Finance, bEarn, Bogged Finance, Uranium Finance, Meerkat Finance, SafeMoon, and Spartan Protocol have all suffered exploits on Binance Smart Chain. Binance has now turned to blockchain intelligence company CipherTrace for analytics support in a bid to mitigate further incursions.
Uranium Finance, an automated market maker platform on the Binance Smart Chain, has reported a security incident that resulted in a loss of about $50 million.
Tweeting on Wednesday, Uranium revealed that the exploit targeted its v2.1 token migration event and that the team was in contact with the Binance security team to mitigate the situation.
(1/2)‼️ Uranium migration has been exploited, the following address has 50m in it The only thing that matters is keeping the funds on BSC, everyone please start tweeting this address to Binance immediately asking them to stop transfers.
The hacker reportedly took advantage of bugs in Uranium’s balance modifier logic that inflated the project’s balance by a factor of 100.
This error reportedly allowed the attacker to steal $50 million from the project. As of the time of writing, the contract created by the hacker still holds $36.8 million in Binance Coin (BNB) and Binance USD (BUSD).
The remaining stolen funds include 80 Bitcoin (BTC), 1,800 Ether (ETH), 26,500 Polkadot (DOT), 5.7 million Tether (USDT), as well as 638,000 Cardano (ADA) and 112,000 u92, the project’s native coin.
Details from BscScan show the attacker swapping the ADA and DOT tokens for ETH, upping the Ether stash to about 2,400 ETH.
Meanwhile, the alleged mastermind of the theft has already moved 2,400 ETH, worth about $5.7 million, using the Ethereum privacy tool Tornado Cash.
Data from Ethereum chain monitoring service Etherscan shows the funds moving in 100 ETH sums, with the cross-chain decentralized exchange bridge AnySwap used to migrate funds from BSC to the Ethereum network.
Source: Etherscan
According to Uranium, the project has reached out to the Binance security team to prevent the hacker from moving more funds out of the BSC ecosystem.
Binance did not immediately respond to Cointelegraph’s request for comment. A spokesperson for Uranium revealed that the bug was yet to be patched and that users have been advised to stop providing liquidity on the project and to cash out their funds.
The team also created a Telegram group for victims of the hack while promising to provide updates on the progress being made to recover the stolen funds.
Wednesday’s hack is the second attack on the Uranium project in quick succession. Earlier in April, hackers exploited one of the platform’s pools, stealing about $1.3 million worth of BUSD and BNB.
Indeed, the incident led to the first migration to v2 less than two weeks ago. In a previous announcement, the Uranium developer team said that multiple entities had audited its v2 contracts and that it had learned from its previous mistakes.
Meanwhile, speculation is rife as to whether the attack was an inside job, given the sudden decision to engineer another version upgrade barely 11 days after completing the v2 migration.
Today @UraniumFinance got rekt. The Uranium devs had just deployed v2 of their contracts, and 11 days later they asked everyone to migrate to v2.1. Pretty odd timing for an upgrade, right?
Hacks associated with smart contract bugs are commonplace within the decentralized finance arena even for fully audited projects — as was the case with MonsterSlayer Finance earlier in April. Back in March, Meerkat, a Yearn.finance clone on the BSC, reportedly “exit-scammed” its users, stealing $31 million in the process.
Days later, the project’s developer team revealed the alleged “rug pull” was a test while outlining plans to return the funds. TurtleDex, another BSC-based project, also exit-scammed shortly after its launch, draining over 9,000 BNB tokens raised during the pre-sale.