Delta Prime DeFi hacker exploited token minting bug, managed to empty $6M

• Hacker exploited Delta Prime’s improve operate to mint huge tokens.
• Over $6M in property had been stolen, together with Bitcoin, Ether, and stablecoins.
• Assault exposes dangers of upgradable contracts in decentralized finance.

Delta Prime, a DeFi platform working on the Arbitrum community, has fallen sufferer to a serious cyberattack the place a hacker exploited a vulnerability within the platform’s token minting system, efficiently draining over $6 million from its liquidity swimming pools.

The breach started when the attacker gained management of Delta Prime’s admin account, probably by stealing the developer’s personal key.

How the Delta Prime hack unfolded

With entry to the admin pockets, the hacker used the platform’s improve operate to switch a number of liquidity pool contracts. These contracts had been linked to proxy addresses, a mechanism designed to permit builders to implement software program upgrades.

Nonetheless, as a substitute of upgrading the software program, the attacker pointed the contracts to malicious variations that allowed them to mint arbitrarily massive numbers of tokens.

In keeping with blockchain knowledge supplied by block explorer Arbiscan, the hacker initially minted over 115 duovigintillion Delta Prime USD (DPUSDC) tokens, an astronomical determine represented as 1.1*10^69 in scientific notation.

DPUSDC serves as a deposit receipt token for the USDC stablecoin, meant to be redeemed at a 1:1 ratio.

Regardless of minting an enormous quantity of DPUSDC, the hacker redeemed solely $2.4 million price of USDC.

The identical exploit was utilized to different deposit receipt tokens, together with Delta Prime Wrapped Bitcoin (DPBTCb), Delta Prime Wrapped Ether (DPWETH), and Delta Prime Arbitrum (DPARB). The attacker minted huge portions of those tokens and redeemed a small fraction, in the end stealing over $6 million in property, together with Bitcoin, Ether, Arbitrum, and USDC.

Cyvers, an on-chain safety platform, was one of many first to report the assault, warning that the losses had been initially $4.5 million however shortly escalated because the hacker continued draining swimming pools.

🚨ALERT🚨@DeltaPrimeDefi has confronted a safety incident on their admin keys.
Attacker had management on the personal key of 0x40e4ff9e018462ce71fa34abdfa27b8c5e2b1afb
then he upgraded the proxy!

To this point $5.93M has been drained!

Need to hold your organization off our alerts radar? Study… https://t.co/yOmNZJyp5l pic.twitter.com/lztFvXVmfI

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) September 16, 2024

Blockchain safety specialist Chaofan Shou later confirmed that the overall theft had reached roughly $6 million.

Delta Prime @DeltaPrimeDefi admin personal key leaked. All swimming pools are drained. $7M loss already. Withdraw ASAP!https://t.co/uNn5nZoHp3 pic.twitter.com/se3RebRjpX

— Chaofan Shou (@shoucccc) September 16, 2024

This incident underscores the dangers related to upgradable contracts within the DeFi ecosystem. Though upgradable contracts enable builders to repair bugs post-deployment, they introduce a centralization danger if an admin account is compromised, as seen within the Delta Prime hack.

The assault on Delta Prime is a part of a rising pattern of high-profile DeFi breaches, with consultants warning that future targets may embody even bigger establishments, corresponding to Bitcoin exchange-traded funds (ETFs), which maintain billions in digital property.