BSV
$81.08
Vol 143.02m
5.75%
BTC
$98640
Vol 106637.48m
3.1%
BCH
$575.69
Vol 1506.91m
-1.72%
LTC
$131.56
Vol 2166.04m
1.08%
DOGE
$0.42
Vol 10123.89m
4.62%
Getting your Trinity Audio player ready...

The team behind Kokomo Finance, a lending protocol built on Ethereum Layer 2 network Optimism, has allegedly pulled off a $4 million exit scam.

New York Web3 security company CertiK first discovered the exploit. In addition to the smart contract exploit, the Kokomo developers also took down the project’s social media accounts, CertiK revealed.

CertiK first discovered high slippages on KOKO, the lending platform’s native token. KOKO has since plunged to $0.00066244 at press time, a 98.6% dip.

In its analysis of the attack, the cybersecurity company said the developers had deployed the attack contract cBTC, paused borrowing, and reduced reward speed. They then set the implementation contract into a malicious one.

cBTC is a derivative of Wrapped BTC (wBTC) issued on the Ethereum network.

The developers reportedly used one of their addresses to approve a transfer of over 7,000 Sonne Wrapped BTC, yet another BTC derivative issued on Ethereum. They then used these tokens to swap all the liquidity that users had supplied to Kokomo, walking away with about $4 million in user funds.

After the alleged heist, the developers took down the social media accounts and the Kokomo website, vanishing in Asian morning hours on Monday.

Kokomo launched on March 25, offering users a non-custodial protocol to borrow, lend, and trade wrapped BTC, USDT, Ether, USDC, and the DAI stablecoin. Its popularity quickly surged, with DeFiLlama showing that two days after launch, it accumulated $2 million in total value locked (TVL).

Kokomo was audited just days prior by 0xGuard, a smart contract auditing firm that has audited over 100 other projects.

In its report, 0xGuard found no issues with most of the protocol except for one major loophole:

“The owner has a one-time ability to mint 45% of MAX_SUPPLY, i.e. 45e24 tokens, to an arbitrary address.”

Earlier this month, DeFi platform Euler Finance lost $197 million to a flash loan attack.

Watch: Tokenizing Assets & Securities on Blockchain

Recommended for you

Coinbase scraps Turkey plans, wants to dump AML laws
After ceasing USDC rewards in the European Economic Area, Coinbase withdrew its Turkey licensing plans while CEO Armstrong painted some...
December 4, 2024
RBI: Blockchain, tokenized assets push lawmakers to stay alert
RBI's M. Rajeshwar Rao said that the new processes backed by AI, blockchain, and tokenized assets have pushed policymakers to...
December 4, 2024
Advertisement
Advertisement
Advertisement