On July 7th, 2023, Multichain experienced one of the largest cryptocurrency hacks to date, resulting in the loss of $126 million worth of cryptocurrency. Roughly ~56% of these funds were denominated in stablecoins. Much of the rest was comprised of WBTC and WETH. At the time of the hack, it was widely believed that the exploit had been committed by an external hacker. However, in a report circulated on July 10th, the blockchain analysis firm Chainalysis wrote “… this exploit could be an inside job or rug pull, due in part to recent issues suffered by Multichain”.
Multichain Hack Aftermath
Within a few days of the hack, the Fantom Foundation reported that Tether and Circle had frozen >$62.5 million worth of stablecoins on Ethereum that had been transferred from Multichain.
Roughly a week later, the official Multichain Twitter account tweeted a breakdown of the events surrounding the hack. They admitted that no one on the team had access to the MPC node servers that were involved in operating the Multichain platform. They went on to say that the current state of the assets was unknown and both the CEO of Multichain, Zhaojun, and his sister were currently in police custody with no outside contact. Multichain also stated that the team would be suspending operations due to the lack of information and operational funding.
With the funds from the Multichain hack in limbo, the Fantom blockchain has been the most negatively impacted chain due to the widespread use of Multichain’s Fantom bridge. At the time of the hack, over 50% of all Fantom assets, excluding FTM, were issued by Multichain. The vast majority of stablecoins (80%+) on Fantom were also issued through Multichain.
At the beginning of July, Fantom had roughly $204 million in Total Value Locked (TVL), according to data from DefiLlama. As of August 15th, that TVL has plummeted to $62.75 million, a loss of 69.2%. TVL levels this low have not been seen since May of 2021. This hack has severely impacted the reputation of the Fantom blockchain and sent millions of dollars of value fleeing to the safety of other blockchains.
Some DeFi protocols built on Fantom have fared even worse than Fantom itself. Spookyswap, the largest DEX currently active on Fantom, peaked in July at a TVL of $72.25 million. As of August 15th, it has dramatically fallen to $19.64 million, a 73% decline in the span of a month. This is likely due to the liquidity pools being mostly made up of wrapped tokens issued by Multichain.
Fantom was not the only blockchain negatively impacted by the Multichain hack. Moonriver was also severely impacted, having a peak TVL at the beginning of July of $10.52 million that has now sunk to $5.86 million, a 44.3% decline. The MOVR token has also been affected, falling ~33% in the month following the hack.
While Fantom and Moonriver were hit hardest by the hack, many other blockchains also had exposure. Below is a chart of the TVL in Multichain on July 5th as a percentage of the overall TVL of each blockchain.
Conclusion
The Multichain hack serves as a cautionary tale, emphasizing the need for redundant security measures and thorough due diligence within the realm of cryptocurrency ventures. As the industry continues to evolve and innovate, it is incumbent upon participants to remain vigilant against potential threats, adapt to changing circumstances, and develop resilient strategies that prioritize the protection of digital assets and the sustainability of blockchain ecosystems.
In a landscape where innovation and challenges coexist, the Multichain hack stands as a testament to the ongoing efforts required to safeguard the promise of decentralized finance and blockchain technologies, ensuring their continued growth and resilience in the face of adversity.