FEG token holders in despair after third hack causes 99% dump

The project’s response to the “Irregular Transactions” acknowledged its users’ frustration, which were shared by the team. It initially suspected “a vulnerability in the wormhole bridge, which had previously undergone an audit” by Peckshield (which claims to have identified the root cause, but is yet to comment officially).

In the meantime, crypto security and auditing firm BlockSec conducted its own analysis of the hack, finding that “only the relayer can register withdrawal in the SmartBridge. However, when receiving a wormhole bridge message, the relayer doesn’t check if the source address is allowed to trigger the withdrawal registration.”

The hacker was then able to craft a malicious bridge message on one chain, fraudulently withdraw large amounts of FEG on the destination chain, and swap it for the existing liquidity. The same three steps were followed on each chain.

The FEG token ties together the project’s “SmartDeFi” token launchpads on ETH, Base and BNB Chain. According to Cyvers, the attacker made over $1 million dumping the tokens: 96 ETH, 73 ETH and 712 BNB profit on each chain, respectively.

Many voiced their frustrations and disbelief via X despite replies to the team’s statement being disabled. Users remarked on the loss of credibility, a lack of surprise, feeling “trapped,” and even suggesting the events may have been inside jobs.

Some did show support, however, pointing to the team’s “proactive approach” and taking comfort in FEG’s “real-world utility,” while dismissing security concerns as “woke.”

This isn’t FEG’s first rodeo

May 2022 saw the project lose $1.3 million to a flash loan attack which also exploited a data validation issue to drain FEG tokens. Despite “respectfully request[ing]” the return of stolen funds, they were laundered via Tornado Cash a few days later.