Track market-moving stories before they get noisy

Unizen DEX Faces Major Security Breach; Over $2 Million Loss Reported

Unizen, a decentralized finance (defi) protocol, has committed to reimbursing users who lost $750,000 or less at the earliest opportunity, following a significant security breach that resulted in the loss of approximately $2.1 million in user funds.

Blockchain analytics firms PeckShield and SlowMist played crucial roles in identifying and assessing the breach on March 9.

PeckShield first detected an “approve issue” on March 9, leading to the discovery that over $2 million had been siphoned from the platform. SlowMist’s investigation confirmed the total losses amounted to around $2.1 million, noting that the stolen funds were converted from Tether (USDT) to the stablecoin Dai (DAI).

The hacker exploited an external call vulnerability within the Ethereum-based contract, converting the stolen USDT to DAI. The funds remain stationary, with users urged to revoke any approvals associated with the hacker’s address to prevent additional losses. 

In response to the theft, Unizen proactively reached out to the hacker with an on-chain message on March 10, offering a 20% bounty for the return of the remaining stolen assets. The company has also engaged with law enforcement and forensic experts to trace the hacker’s identity. 

Despite the ongoing negotiations for the bounty, Unizen announced on March 11 its plan to begin compensating 99% of the victims immediately, prioritizing a meticulous, individualized approach to the reimbursement process.

Sean Noga, the founder and CEO of Unizen, has provided personal funds to facilitate the reimbursements, ensuring that users who suffered losses below the $750,000 threshold receive their funds back in USDT or USD Coin (USDC). Cases involving losses exceeding $750,000 are to be addressed individually. Furthermore, Unizen has released a video guide to assist users in revoking platform approvals to mitigate further risks.

Martin Granström, Unizen’s Chief Technology Officer, disclosed on social media platform X that sufficient evidence has been gathered for a comprehensive incident report, which will be published in collaboration with external third-party firms. Granström also reiterated the company’s commitment to enhancing its security measures to prevent future incidents.

This incident underscores the urgent need for the DeFi sector to continually reassess and enhance their security measures to protect user assets from complex online attacks. In a recent event last month, Seneca Protocol experienced a severe security compromise, leading to a sharp 65% decline in the price of its SEN token. CertiK reported that the assailant took advantage of a flaw within the protocol, making off with digital assets valued at around $3 million. Furthermore, the offender moved 1,000 ETH between two independent accounts, bringing the total estimated damages to about $6.4 million.

Hassan Shittu

Journalist

Hassan Shittu

Part of the Team Since

Jun 2023

About Author

Hassan, a Cryptonews.com journalist with 6+ years of experience in Web3 journalism, brings deep knowledge across Crypto, Web3 Gaming, NFTs, and Play-to-Earn sectors. His work has appeared in...

Has Also Written

Last updated: 

March 11, 2024

Decentralized finance (DeFi) protocol Unizen has taken swift action in response to a recent security breach that resulted in the loss of approximately $2.1 million in user funds. Following the compromise, Unizen pledged to reimburse affected users who lost up to $750,000, aiming to restore confidence in its platform and uphold its commitment to user protection.

Defi Platform Unizen Faces $2.1 Million Loss in Unauthorized Access Security Breach Dear unizen community,

After an arduous weekend, we have made the strategic decision to make over 99% of those affected from our community completely whole with immediate effect.

Our CEO / Founder, Sean Noga, has decided to loan Unizen the majority of the immediate… pic.twitter.com/d9GyaH3j8Y

— unizen (@unizen_io) March 11, 2024

On March 9, the blockchain analytics firm PeckShield identified an “approve issue” within the DeFi platform, signaling unauthorized access and the drainage of over $2 million in funds. Promptly, security advisories were issued, urging users to revoke approvals to mitigate further losses.

Another blockchain security firm, SlowMist, investigated and confirmed that the total losses amounted to around $2.1 million, attributing them to an open external call vulnerability.

The hacker exploited an external call vulnerability within the Ethereum-based contract, converting the stolen USDT to DAI. The funds remain stationary, with users urged to revoke any approvals associated with the hacker’s address to prevent additional losses.

In response to the breach, Unizen acknowledged the incident and assured users that the team was working diligently to enhance platform security and prevent future breaches. The company has established a dedicated form to address concerns from affected users and cautioned against communicating with unofficial Unizen accounts on social media platforms.

On March 10, Unizen initiated cooperation with law enforcement and forensic experts to identify the perpetrator. Unizen proactively reached out to the hacker with on-chain messages urging the return of the stolen funds, accompanied by a demonstration of ownership through a transfer from the foundation wallet to the hacker’s Ethereum wallet.

Unizen emphasized its ongoing collaboration with law enforcement and requested the prompt return of funds to avoid further legal action. As an incentive for cooperation, the company offered a 20% bounty as a token of appreciation for white-hat efforts.

Unizen’s Reimbursement Plan Following an Unauthorized Access Breach
While bounty discussions continued, Unizen took proactive steps to alleviate the impact on affected users. On March 11, the company announced its intention to reimburse 99% of victims immediately, prioritizing a meticulous, individualized approach to the reimbursement process.

Dear unizen community,

After an arduous weekend, we have made the strategic decision to make over 99% of those affected from our community completely whole with immediate effect.

Our CEO / Founder, Sean Noga, has decided to loan Unizen the majority of the immediate… pic.twitter.com/d9GyaH3j8Y

— unizen (@unizen_io) March 11, 2024

Sean Noga, the founder and CEO of Unizen, extended personal loans to facilitate the refunds, which commenced on the same day for users who lost less than $750,000.

Beginning on March 11, refunds will be distributed to users who lost amounts below $750,000, facilitated in either USDT or USD Coin (USDC). For users affected by losses exceeding $750,000, Unizen assures a personalized resolution process.

Alongside the reimbursement initiative, the company released a comprehensive video guide to educate users on reviewing and revoking approvals within the platform, minimizing susceptibility to future vulnerabilities.

Unizen’s chief technology officer, Martin Granström, disclosed on X that Unizen has gathered sufficient evidence for a comprehensive post-mortem report and engaged third-party firms for assistance. Granström assured users that an incident report would be released shortly and also affirmed the company’s dedication to bolstering security measures, pledging increased investment in safeguarding user assets for the future.

The Unizen exploit joins a string of crypto-related exploits in February, including the recent WOOFi breach, which resulted in losses of approximately $8.75 million. As Unizen prepares to release its post-mortem report, the platform’s engineering team remains focused on restoring normal operations while bolstering security measures to safeguard user assets.

In a recent turn of events, the Decentralized Finance (DeFi) platform Unizen has suffered a significant security breach, leading to a loss of approximately $2.1 million in user funds.

The compromise was initially detected on March 9 by PeckShield, a blockchain analytics company, which identified an “approve issue” resulting in the drain of over $2 million.

PeckShield’s discovery prompted them to advise users to revoke their platform approvals immediately to prevent further losses. Additionally, SlowMist, another security firm, confirmed the total losses to be around $2.1 million, revealing that the attacker had exchanged the stolen Tether for Dai, a stablecoin.

In response to the incident, Unizen communicated directly with the hacker via an on-chain message on March 10, proposing a 20% bounty for the return of the pilfered assets.

The platform also disclosed that they were collaborating with law enforcement and forensic experts to unmask the hacker’s identity.

Despite the ongoing negotiations for the return of the stolen funds, Unizen made a prompt decision to reimburse the affected users.

By March 11, the protocol announced its intention to compensate 99% of the victims as swiftly as possible.

READ MORE: Sam Altman Reinstated to OpenAI Board Amid Legal Battle with Elon Musk

The statement detailed plans for individualized distribution processes, emphasizing a cautious and thorough approach to ensure accuracy.

Unizen’s commitment to rectifying the situation was further underscored by an announcement that founder and CEO Sean Noga had provided personal funds to facilitate the reimbursements.

Starting March 11, users who incurred losses of up to $750,000 were assured of receiving their refunds, either in USDT or USD Coin. For those who faced greater losses, Unizen promised tailored resolutions.

Moreover, Unizen released an instructional video to guide users on reviewing and revoking platform approvals, aiming to forestall any additional vulnerabilities.

Martin Granström, Unizen’s chief technology officer, affirmed on X that sufficient evidence had been gathered for a comprehensive analysis of the breach.

Granström announced the forthcoming release of a detailed incident report and pledged an investment in enhanced security measures to prevent future exploits.

To submit a crypto press release (PR), send an email to [email protected].

No information published in Crypto Intelligence News constitutes financial advice; crypto investments are high-risk and speculative in nature.

Unizen hacker transfers $2.1M stolen funds to Tornado Cash

Unizen Hack Update: Over $2 Million Laundered by Hacker Through Tornado Cash

BlackRock launches Bitcoin ETP in Europe