On July 7, 2023, a large amount of multi-chain assets of about 125 million US dollars in the cross-chain protocol Multichain outflowed to multiple wallets, including 122 million assets (57.8m USDC, 1.024k WBTC, 7.214k WETH, 4.178m DAI, 491.657k LINK, 910.654k UNIDX, 1.493m USDT, 9.674m WOO, 1.297m ICE, 1.362m CRV, 134.48 TFI, and 502.4k TUSD); $6.835 million assets (4.8 3m USDC , 1.042m USDT, 780k DAI, and 6.122 WBTC); and 666.47k USDC outflow from Multichain: Dogechain Bridge. At present, the Multichain asset bridge activity has been suspended, and the last transaction will be held at 06:56 UTC+8 on July 7.
According to the deExplorer browser, some users are exchanging assets on the Fantom chain for other chain assets at a discount through DLN Trade. According to the latest transactions, Fantom 1 USDC can be converted into BSC 0.9 USDC, Polygon 0.88 USDT, etc., with a discount of about 10%.
The official Multichain tweet stated that the locked assets on the Multichain MPC address have been abnormally moved to an unknown wallet. The team is not sure what happened and is currently investigating; and recommends that all users suspend the use of Multichain services and revoke all Multichain-related contract authorizations.
@Loki_Zeng analyzed that the abnormal capital outflow of Multichain has the following characteristics: the asset transfer lasts for a long time, a small amount of 2USDC is tested before the transfer, each asset is transferred to an independent wallet, and there is no further action after that (such as transfer to the exchange, swap, mixed currency), the receiving wallet is completely clean.
Based on these characteristics, it can be deduced that: 1) The transferor has sufficient time. Considering the technical characteristics of MPC, the transferor may have completely obtained the control of the private key fragment exceeding the threshold in some way. 2) "Attack method" It is very simple, it is a pure transfer operation, there is no contract, and there is a test. The attacker is probably not a hacker.
Multichain Historical Events
AnySwap V3 was attacked before the name change on July 11, 2021, and lost assets totaling 2,398,496.02 USDC and 5,509,222.73 MIM. According to the official analysis, the reason for this attack is that there are two transactions signed by the same account in the BSC chain. If the transactions signed by the same account have the same r-value of the rsv signature, the hacker can reversely deduce the private key of the account. The AnySwap team reproduced the hacker's method of operation and stated that it will provide full compensation.
On December 21, 2021, the renamed Multichain announced the completion of US$60 million in financing, led by Binance Labs, Sequoia China, IDG Capital, Three Arrows Capital, DeFiance Capital, Circle Ventures, Tron Foundation, Hypersphere Ventures, Primitive Ventures, Magic Ventures and HashKey participated.
On December 23, 2021, Multichain, which had just completed a huge financing, had an equity dispute. Co-founder and CEO Zhao Jun claimed that he owned 100% of the foundation's equity, but the FUSION Foundation claimed that Qian Dejun owned 40% of the equity. Qian Dejun has participated in the creation of projects such as Quantum Chain, VeChain and FUSION.
On January 18, 2022, Multichain discovered an important vulnerability affecting six Tokens (WETH, PERI, OMT, WBNB, MATIC, AVAX), and stated that the vulnerability has been successfully fixed, and all users' assets are safe. Cross-chain transactions will also not be affected. However, the security company has since discovered that the loophole has been hacked and the coins have been stolen. The community calls on users to revoke the authorization as soon as possible. The security incident caused approximately $3 million in asset losses.
On January 13, 2023, Multichain launched the next-generation new technology product zkRouter, and released the zkRouter white paper. zkRouter is a trustless, general-purpose cross-chain infrastructure, which has the advantages of no trust dependencies, light computing on the chain, general purpose, low latency, and no asset collateral. As Multichain's latest solution, zkRouter utilizes ZKP (Zero Knowledge Proof, Zero Knowledge Proof) to connect multiple blockchain networks and achieve seamless interoperability.
On March 15, 2023, Multichain announced that its total transaction volume had exceeded $100 billion. The total number of cross-chain users exceeds 830,000, the number of cross-chain transactions is 5.04 million, and the average single cross-chain fund is about 20,000 US dollars. Multichain has currently connected 83 public chains, supports more than 3,400 kinds of assets cross-chain, and cross-chain liquidity exceeds 18 One hundred million U.S. dollars.
On May 24, 2023, several users reported that there was an abnormal delay in the arrival of Multichain cross-chain funds. Multichain first responded in Discord: "Because the upgrade of the back-end nodes took longer than expected, all affected transactions will arrive after the upgrade is completed." Then said: "Some cross-chain routes cannot be used due to force majeure. The service recovery time is unknown. After the service is restored, pending transactions will be automatically credited.” At the same time, Multichain co-founder Alfred Xu said in the Telegram community that the founder was arrested by the police: “The team is working normally.” On May 25, Qian Dejun, the founder of the Fusion Foundation, said that Zhaojun, the founder of Multichain, cannot be contacted at present, "Let's see if we can provide technical or other help. The most important thing is that the user's assets are safe and people are safe." .
Various parties affected by Multichain have since taken measures.
On May 25, 2023, Binance announced that while waiting for a clear explanation from the Multichain team, deposits in some bridging token networks, such as POLS-BSC, ACH-BSC, BIFI-FTM, etc., will be suspended; on the same day, Andre Cronje ( AC) stated that the Fantom Foundation stopped providing liquidity for MULTI tokens on SushiSwap; on the 27th, due to concerns about the stability of anyUSDC, the main USDC asset of Multichain and Fantom, LayerZero cross-chain bridge protocol Stargate issued a proposal to disable Fantom Pool and cross-chain paths, Set the STG release in Fantom Pool to 0, disconnect Fantom Pool from other liquidity pools, remove and unlock anyUSDC POL through Multichain, then deposit POL into Ethereum USDC Pool, and add existing LPs to the whitelist .
On June 1, 2023, Multichain officially tweeted that in the past two days, due to unforeseen circumstances, the Multichain protocol had multiple problems. The team has done everything possible to maintain the protocol running, but we are currently unable to reach CEO Zhaojun and gain the necessary server access for maintenance. This afternoon, there was a problem with the scanning node network of Router5, which affected the normal cross-chain services of some chains. Also, this issue is beyond the team's current purview and capabilities. In order to protect the interests of the majority of users, we decided to suspend the corresponding cross-chain services for the affected chains on the UI. Last week, the same problem happened on Router2. We thank users for their understanding and ask our partners to stop directly calling Multichain protocol smart contracts on the affected chains for cross-chain operations. All affected chains are: Kekchain, PublicMint, Dyno Chain, Red Light Chain, Dexit, Ekta, HPB, ONUS, Omax, Findora, Planq.
View Original
The content is for reference only, not a solicitation or offer. No investment, tax, or legal advice provided. See Disclaimer for more risks disclosure.
The cross-chain bridge Multichain is in trouble again, and this article sorts out its important historical events
EDIT**|**Wu Said Blockchain
On July 7, 2023, a large amount of multi-chain assets of about 125 million US dollars in the cross-chain protocol Multichain outflowed to multiple wallets, including 122 million assets (57.8m USDC, 1.024k WBTC, 7.214k WETH, 4.178m DAI, 491.657k LINK, 910.654k UNIDX, 1.493m USDT, 9.674m WOO, 1.297m ICE, 1.362m CRV, 134.48 TFI, and 502.4k TUSD); $6.835 million assets (4.8 3m USDC , 1.042m USDT, 780k DAI, and 6.122 WBTC); and 666.47k USDC outflow from Multichain: Dogechain Bridge. At present, the Multichain asset bridge activity has been suspended, and the last transaction will be held at 06:56 UTC+8 on July 7.
According to the deExplorer browser, some users are exchanging assets on the Fantom chain for other chain assets at a discount through DLN Trade. According to the latest transactions, Fantom 1 USDC can be converted into BSC 0.9 USDC, Polygon 0.88 USDT, etc., with a discount of about 10%.
The official Multichain tweet stated that the locked assets on the Multichain MPC address have been abnormally moved to an unknown wallet. The team is not sure what happened and is currently investigating; and recommends that all users suspend the use of Multichain services and revoke all Multichain-related contract authorizations.
@Loki_Zeng analyzed that the abnormal capital outflow of Multichain has the following characteristics: the asset transfer lasts for a long time, a small amount of 2USDC is tested before the transfer, each asset is transferred to an independent wallet, and there is no further action after that (such as transfer to the exchange, swap, mixed currency), the receiving wallet is completely clean.
Based on these characteristics, it can be deduced that: 1) The transferor has sufficient time. Considering the technical characteristics of MPC, the transferor may have completely obtained the control of the private key fragment exceeding the threshold in some way. 2) "Attack method" It is very simple, it is a pure transfer operation, there is no contract, and there is a test. The attacker is probably not a hacker.
Multichain Historical Events
AnySwap V3 was attacked before the name change on July 11, 2021, and lost assets totaling 2,398,496.02 USDC and 5,509,222.73 MIM. According to the official analysis, the reason for this attack is that there are two transactions signed by the same account in the BSC chain. If the transactions signed by the same account have the same r-value of the rsv signature, the hacker can reversely deduce the private key of the account. The AnySwap team reproduced the hacker's method of operation and stated that it will provide full compensation.
On December 21, 2021, the renamed Multichain announced the completion of US$60 million in financing, led by Binance Labs, Sequoia China, IDG Capital, Three Arrows Capital, DeFiance Capital, Circle Ventures, Tron Foundation, Hypersphere Ventures, Primitive Ventures, Magic Ventures and HashKey participated.
On December 23, 2021, Multichain, which had just completed a huge financing, had an equity dispute. Co-founder and CEO Zhao Jun claimed that he owned 100% of the foundation's equity, but the FUSION Foundation claimed that Qian Dejun owned 40% of the equity. Qian Dejun has participated in the creation of projects such as Quantum Chain, VeChain and FUSION.
On January 18, 2022, Multichain discovered an important vulnerability affecting six Tokens (WETH, PERI, OMT, WBNB, MATIC, AVAX), and stated that the vulnerability has been successfully fixed, and all users' assets are safe. Cross-chain transactions will also not be affected. However, the security company has since discovered that the loophole has been hacked and the coins have been stolen. The community calls on users to revoke the authorization as soon as possible. The security incident caused approximately $3 million in asset losses.
On January 13, 2023, Multichain launched the next-generation new technology product zkRouter, and released the zkRouter white paper. zkRouter is a trustless, general-purpose cross-chain infrastructure, which has the advantages of no trust dependencies, light computing on the chain, general purpose, low latency, and no asset collateral. As Multichain's latest solution, zkRouter utilizes ZKP (Zero Knowledge Proof, Zero Knowledge Proof) to connect multiple blockchain networks and achieve seamless interoperability.
On March 15, 2023, Multichain announced that its total transaction volume had exceeded $100 billion. The total number of cross-chain users exceeds 830,000, the number of cross-chain transactions is 5.04 million, and the average single cross-chain fund is about 20,000 US dollars. Multichain has currently connected 83 public chains, supports more than 3,400 kinds of assets cross-chain, and cross-chain liquidity exceeds 18 One hundred million U.S. dollars.
On May 24, 2023, several users reported that there was an abnormal delay in the arrival of Multichain cross-chain funds. Multichain first responded in Discord: "Because the upgrade of the back-end nodes took longer than expected, all affected transactions will arrive after the upgrade is completed." Then said: "Some cross-chain routes cannot be used due to force majeure. The service recovery time is unknown. After the service is restored, pending transactions will be automatically credited.” At the same time, Multichain co-founder Alfred Xu said in the Telegram community that the founder was arrested by the police: “The team is working normally.” On May 25, Qian Dejun, the founder of the Fusion Foundation, said that Zhaojun, the founder of Multichain, cannot be contacted at present, "Let's see if we can provide technical or other help. The most important thing is that the user's assets are safe and people are safe." .
Various parties affected by Multichain have since taken measures.
On May 25, 2023, Binance announced that while waiting for a clear explanation from the Multichain team, deposits in some bridging token networks, such as POLS-BSC, ACH-BSC, BIFI-FTM, etc., will be suspended; on the same day, Andre Cronje ( AC) stated that the Fantom Foundation stopped providing liquidity for MULTI tokens on SushiSwap; on the 27th, due to concerns about the stability of anyUSDC, the main USDC asset of Multichain and Fantom, LayerZero cross-chain bridge protocol Stargate issued a proposal to disable Fantom Pool and cross-chain paths, Set the STG release in Fantom Pool to 0, disconnect Fantom Pool from other liquidity pools, remove and unlock anyUSDC POL through Multichain, then deposit POL into Ethereum USDC Pool, and add existing LPs to the whitelist .
On June 1, 2023, Multichain officially tweeted that in the past two days, due to unforeseen circumstances, the Multichain protocol had multiple problems. The team has done everything possible to maintain the protocol running, but we are currently unable to reach CEO Zhaojun and gain the necessary server access for maintenance. This afternoon, there was a problem with the scanning node network of Router5, which affected the normal cross-chain services of some chains. Also, this issue is beyond the team's current purview and capabilities. In order to protect the interests of the majority of users, we decided to suspend the corresponding cross-chain services for the affected chains on the UI. Last week, the same problem happened on Router2. We thank users for their understanding and ask our partners to stop directly calling Multichain protocol smart contracts on the affected chains for cross-chain operations. All affected chains are: Kekchain, PublicMint, Dyno Chain, Red Light Chain, Dexit, Ekta, HPB, ONUS, Omax, Findora, Planq.