Crypto Thief Aims for the Moon, Trips Over Couch—Leaves $26.8M Behind!

by

Observe, if you will, a thief in the digital kaleidoscope, intent on claiming a fabulous $27 million loot from the labyrinthine burrow of Meta Pool. Yet alas! He emerges not as a bejeweled dragon but as a bewildered hamster, clutching a measly $132,000—like a tipsy magician invited to Fort Knox, only to end up pocketing parking meter change. To his chagrin (and perhaps the network’s delight), low liquidity, that stolid beast, together with a swift contract pause, foil him at the gates.

This luckless bandit conjured—one imagines with a dramatic flourish—9,705 of Meta Pool’s mpETH tokens, worth nearly $27 million. And yet, from the grand bazaar of liquidity swap pools, he could only rustle up 52.5 Ether—about enough for a secondhand Lada and perhaps a celebratory pastry. Per Meta Pool’s own melancholic blog, the pools’ anemia in volume proved as uninspiring as British weather. Quick detection and decisive pausing of contracts stymied “further unauthorized activity.” (‘Further losses’—code for ‘enough drama, please!’)

Hacker Exploits “Fast Unstake”—or, How to Make a Grand Entrance and a Tiny Exit

Meta Pool’s co-founder Claudio Cossio, keyboard in trembling hand, revealed on X that the attacker wriggled through a “fast unstake functionality.” This sorcery allowed him to mint thousands of mpETH tokens—magic, if your idea of magic involves materializing Monopoly money and trying to spend it in Vegas.

Normally, unstaked crypto waits forlornly in a vestibule before real-world use. But the “flash unstake”—bypassing the antechamber—lets it run wild, conditions permitting. PeckShield, summoned to the post-mortem, observed that a “critical bug” let the attacker mint mpETH for free. (Everyone wants free stuff. Unfortunately, no liquidity? No Ferrari. Such is life.)

The villain wielded the notorious ERC4626 mint() function like a child given access to a candy factory. Alas, the checkout counter was closed.

Exploiter Heroically Drains Swap Pools—Somewhat

With steely resolve (or perhaps mild confusion), our exploiter swapped mpETH for a grand haul of 52.5 ETH, siphoning from Ethereum mainnet and Optimism pools. The Optimism pool, alas, was optimistic in name only—liquidity and volume not so much. (“It needs to be cleared…” Meta Pool says, as if waving a broom—don’t panic, your Ethereum is safe, chugging along in the SSV Network and acquiring staking rewards.)

A post-mortem will soon materialize (one pictures a roomful of developers wincing, a few stoicly sipping instant coffee). The mpETH contract remains on elegant pause—everyone waiting for the next move like characters in an unresolved mystery. Meta Pool, with the knighthood of bureaucracy, vows reimbursement—every user whole, patched, polished, and ready to trust again. 😂🤞

Crypto Carnage: The Parade Continues

Elsewhere in the menagerie of crypto exploits, Alex Protocol on the Stacks blockchain enjoyed $8.3 million in losses—an “oops” in self-listing that drained liquidity faster than free WiFi drains patience. Taiwan’s BitoPro, too, confirmed a vanishing act worthy of applause, with $11.5 million slipping from its hot wallets. Digital heists: where the stakes are high and the punchlines, apparently, even higher. 🙃

Read More

2025-06-18 06:14