Top

Suspected Malicious Activity Drains AnySwap Tokens via Multichain Executor

Web3 & Enterprise·July 13, 2023, 12:06 AM

According to an on-chain sleuth known as Spreek, a person is using the Multichain Executor to drain tokens associated with the AnySwap bridging protocol.

Multichain is a cross-chain routing network, established and maintained by a Chinese developer team. It supports in excess of 25 blockchains and more than 1,100 tokens.

Photo by Marek Piwnicki on Unsplash

 

$100 million outflow

This revelation comes after abnormal outflows of over $100 million from Multichain bridges on July 7, which were flagged by the Multichain team. Spreek’s report via Twitter on July 10 states that the Multichain Executor address has been draining anyToken addresses across multiple chains and transferring them to a new externally owned account (EOA).

Evidence provided in the report includes an Ethereum transaction, 0x53ede4462d90978b992b0a88727de19afe4e96f0374aa1a221b8ff65fda5a6fe, which called the “anySwapFeeTo” method on the Multichain Router: V4 contract. This transaction resulted in approximately $15,275.90 worth of anyDAI being minted on Ethereum, sent to the Multichain Executor, burned, and exchanged for the underlying DAI backing the asset.

The funds from these transactions were sent to the following address:0x1eed63efba5f81d95bfe37d82c8e736b974f477b. Similarly, on the BNB Smart Chain (BSC), the Multichain Executor used the anySwapFeeTo function to convert $208,997 worth of anyUSDC into Binance-pegged USDC and sent them to the same address. Additionally, 50.80 anyBTC, equivalent to $39,251.43 at the time, was converted into Binance-pegged Bitcoin and sent to the address.

In total, approximately $263,524.33 worth of tokens were sent to this address through the anySwapFeeTo method. Spreek suggests that this behavior could be part of the protocol’s normal functioning. However, a different account engaged in similar activity the day before and ultimately sold the drained tokens, indicating malicious intent.

 

Potential exploit

Spreek theorizes that the attacker may be exploiting the anySwapFeeTo function by setting fees to an arbitrarily large amount, allowing them to drain users’ funds. The function apparently permits setting any value, enabling the address to choose the total value of the token held in that anyToken.

The Multichain incident has puzzled blockchain analysts, as it remains unclear whether it resulted from an exploit or if it was simply large token-holders moving their funds between networks. The mystery began on July 7 when over $100 million worth of tokens were withdrawn from the Ethereum side of Multichain’s bridges and transferred to wallet addresses with no prior transactions. This represented the majority of funds held on each bridge.

 

Hack or rug pull

The Multichain team labeled these withdrawals as “abnormal” and advised users to stop using the protocol. However, they have not disclosed the source or nature of the anomaly. In response to the incident, stablecoin issuers Circle and Tether froze some of the addresses involved in the suspicious transactions. Chainanalysis, a blockchain analytics firm, has commented that the incident appears more like a hack or rug pull rather than a migration.

Adding to the complexity, the Multichain team has reported that their CEO is missing, and they have shut down certain bridges due to losing access to some of the network’s multi-party computation network servers. There have been various concerns relative to Multichain since May. The situation continues to evolve, with ongoing investigations and efforts to mitigate any potential damage caused by the suspected malicious activity.

More to Read
View All
Policy & Regulation·

Dec 03, 2024

HKMA incentivizes tokenization in Hong Kong

The Hong Kong Monetary Authority (HKMA), the Chinese autonomous territory’s central bank, has launched a scheme which subsidizes projects endeavoring to issue tokenized bonds. Grants of up to $321KThe objective behind the initiative, which was announced in a statement published to the HKMA website on Nov. 28, is to nurture moves towards tokenization within Hong Kong’s capital markets. The initiative, titled the Digital Bond Grant Scheme (DBGS), can be accessed by financial services firms for up to two digital bond issuances. The grant may cover up to 50% of what the HKMA describes as “Eligible Expenses” incurred in the process of issuing and establishing the digital bond. A maximum grant level of HK$2.5 million ($321,000) has been established. Digital bond issuers are entitled to the full grant where both basic requirements and additional requirements have been met. A half grant of up to HK$1.25 million ($160,600) has been established for those issuers who have met the basic requirements. The scheme has been opened to applicants from Nov. 28 onwards, with it having been set out to run for an initial period of three years. To fulfill the basic requirements, a bond must be issued in Hong Kong and either be issued on a decentralized ledger technology (DLT) platform, or the project itself must be based in Hong Kong while being involved in the running of a DLT platform.Photo by Fidel Fernando on UnsplashAdditional requirementsThe HKMA has listed four items under additional requirements. These include a need for a digital bond to be issued on a DLT platform run by an entity that is not an associate of the issuer. The bond issuance, whether effected in one instance or in tranches, must account for a value of greater than HK$1 billion ($128.5 million).  The bond must be issued to greater than five investors who are not connected with or associates of the issuer. Finally, the bond must be issued on either the Hong Kong Stock Exchange or a virtual asset trading platform (VATP) licensed and regulated by the Securities and Futures Commission (SFC). Project EvergreenIn 2021, the HKMA launched Project Evergreen, an initiative geared towards exploring how DLT could enhance processes and efficiency within capital markets. On Nov. 28 the HKMA published an update on the project, outlining that since its foundation, tokenization had gained considerable momentum, with $10 billion in tokenized bonds having been issued globally within the last decade. The Hong Kong government carried out two tokenized bond issuances as part of the project. Due to the second issuance being seven times larger than the first one, the HKMA believes that this accounted for institutional investors being attracted to the bond issuance.  In the update, the HKMA outlined that going forward, the plan is to promote wider adoption of what is viable, within the confines of what is possible. The central bank asserted that the DBGS was established on this basis. The update stated: "To fully reap the potential of DLT, we need to keep pushing the boundaries and explore further innovation." In a related development, a report published by the Financial Times on Nov. 28 suggests that the Hong Kong government is considering offering crypto tax breaks to hedge funds and private equity funds.

news
Web3 & Enterprise·

Jan 22, 2024

FSN and Fingo join hands to pursue tokenized securities business

South Korean digital marketing firm FSN has entered into a strategic alliance with Fingo Company, the operator of the music copyright platform Fingo, to jointly work on a tokenized securities project based on the recently raised funds, according to local news site Newsis on Monday (KST).Photo by Chris Liverani on UnsplashUnlocking synergiesThrough this partnership, FSN and Fingo aim to collaborate on a token securities project. As both companies have experience in leveraging IP, they are expected to apply their expertise to the new business. In particular, FSN operates several IP-based Web3 projects such as Sunmiya Club and Bellygom NFT through its subsidiary Finger Labs, through which the firm has been demonstrating its competitive edge. Fingo also owns a variety of content-based IPs and is cooperating with major domestic securities companies. The two firms’ business capabilities are thus expected to create great synergy in the market. Fingo’s service allows anyone to share revenue made from music, a concept referred to as music revenue sharing, which was once limited to creators or singers only. Last year, it took a step into the tokenized securities sphere by signing a business deal with Mirae Asset Securities, the country’s largest asset manager, to establish a token securities service and launch innovative financial investment products. FSN has been gearing up to take on this collaborative project, namely a recent success in raising a total of KRW 10 billion (approximately $7.5 million) in funding. The company explained that with this considerable funding paired with its knowledge of Web3 and blockchain technology and experience in collaborative partnerships, it will be equipped to settle into the tokenized securities market seamlessly. Charting new horizons"As we have secured large-scale funding under stable conditions, we expect to successfully pursue new businesses, including that in tokenized securities," FSN CEO Lee Sang-seok said. "We will steadily expand new businesses by establishing partnerships with companies with competitiveness in various areas, starting with Fingo Company, which has a competitive edge in tokenized securities and music IP," he said.

news
Web3 & Enterprise·

Dec 03, 2025

Token Cat authorizes up to $1B in corporate crypto purchases

Token Cat Limited, a Nasdaq-listed Chinese automotive marketplace formerly known as TuanChe Limited, has approved a new digital asset investment policy that will allow the company to deploy up to $1 billion into cryptocurrencies as part of its treasury strategy. In a press release distributed via Chainwire, the Beijing-headquartered company said its board of directors signed off on a Crypto Asset Investment Policy authorizing the use of a portion of its cash reserves to acquire selected tokens under internal risk-management controls. Any purchased assets will be held with third-party custodians rather than managed in-house, the company said.Photo by Precondo CA on UnsplashThe initial allocation will focus on tokens tied to newer projects in areas such as artificial intelligence, RAW-to-chain infrastructure, and token–equity hybrid models. Further deployments will be evaluated over time and will remain subject to additional board approval, according to the statement. The policy will be implemented under the oversight of Sav Persico, who was recently appointed chief operating officer. Token Cat said he brings decades of experience in technology and blockchain-related businesses and emphasized that the initiative reflects a long-term approach to digital assets rather than a speculative trade. China’s regulation and softer DAT inflowsToken Cat’s decision comes even as China’s central bank continues to stress that crypto-related business activity remains off-limits domestically. According to Reuters, the People’s Bank of China (PBOC) recently reiterated that services involving virtual assets constitute “illegal financial activities” and highlighted that cryptocurrencies do not have the legal status of fiat currency. The statement was issued against the backdrop of what the central bank characterized as a renewed pickup in speculative crypto trading and broader concerns about financial risks. Beyond China, Token Cat’s move fits into a wider trend of companies experimenting with so-called digital asset treasuries (DATs), in which companies commit varying portions of their balance sheets to crypto. Those strategies, however, have seen softer momentum in recent months. Cointelegraph, citing data from DefiLlama, reported that DATs drew about $1.32 billion in fresh capital in November, the lowest monthly intake of 2024. Bitcoin-focused DATs accounted for the bulk of that activity with roughly $1.06 billion of inflows, while Ethereum-based DATs saw about $37 million in outflows. Bitwise chief investment officer Matt Hougan said on X that DATs have generally moved in tandem over the past six months, but he expects that pattern to change as investors begin to differentiate between firms with clearly articulated strategies and those without. He said a limited number of DATs could emerge with more resilient valuations, while others may continue to trade at persistent discounts. Biotech Sonnet advances HYPE-token planDespite the recent slowdown in inflows, new corporate efforts to gain exposure to digital assets continue. One example is Sonnet BioTherapeutics Holdings, a North Carolina–based biotechnology company developing immuno-oncology drugs. On Dec. 2, Sonnet said its shareholders had approved a proposed business combination with Hyperliquid Strategies Inc. (HSI) and Rorschach I LLC. That vote followed an agreement reached in July for Sonnet to merge with Rorschach to form Hyperliquid Strategies, a new entity expected to hold roughly 12.6 million HYPE tokens valued at about $583 million, along with at least $305 million in cash, for a projected combined value of $888 million. Hyperliquid is a decentralized exchange (DEX) built on its own layer-1 blockchain. Its native token, HYPE, has a total supply of one billion and is used for network governance, staking, and smart contract functions on HyperEVM, the platform’s EVM-compatible environment. Sonnet’s move, together with Token Cat’s newly adopted investment policy, adds to a steady stream of corporate initiatives testing the role of digital assets in balance-sheet management. With companies ranging from biotech firms to automotive marketplaces exploring similar strategies, the coming months will show whether crypto holdings can establish themselves as durable components of corporate treasuries. 

news
Loading