Maple Finance Secures $5 Million to Fund Asia Expansion

Suspected Malicious Activity Drains AnySwap Tokens via Multichain ExecutorAccording to an on-chain sleuth known as Spreek, a person is using the Multichain Executor to drain tokens associated with the AnySwap bridging protocol.Multichain is a cross-chain routing network, established and maintained by a Chinese developer team. It supports in excess of 25 blockchains and more than 1,100 tokens.Photo by Marek Piwnicki on Unsplash$100 million outflowThis revelation comes after abnormal outflows of over $100 million from Multichain bridges on July 7, which were flagged by the Multichain team. Spreek’s report via Twitter on July 10 states that the Multichain Executor address has been draining anyToken addresses across multiple chains and transferring them to a new externally owned account (EOA).Evidence provided in the report includes an Ethereum transaction, 0x53ede4462d90978b992b0a88727de19afe4e96f0374aa1a221b8ff65fda5a6fe, which called the “anySwapFeeTo” method on the Multichain Router: V4 contract. This transaction resulted in approximately $15,275.90 worth of anyDAI being minted on Ethereum, sent to the Multichain Executor, burned, and exchanged for the underlying DAI backing the asset.The funds from these transactions were sent to the following address:0x1eed63efba5f81d95bfe37d82c8e736b974f477b. Similarly, on the BNB Smart Chain (BSC), the Multichain Executor used the anySwapFeeTo function to convert $208,997 worth of anyUSDC into Binance-pegged USDC and sent them to the same address. Additionally, 50.80 anyBTC, equivalent to $39,251.43 at the time, was converted into Binance-pegged Bitcoin and sent to the address.In total, approximately $263,524.33 worth of tokens were sent to this address through the anySwapFeeTo method. Spreek suggests that this behavior could be part of the protocol’s normal functioning. However, a different account engaged in similar activity the day before and ultimately sold the drained tokens, indicating malicious intent.Potential exploitSpreek theorizes that the attacker may be exploiting the anySwapFeeTo function by setting fees to an arbitrarily large amount, allowing them to drain users’ funds. The function apparently permits setting any value, enabling the address to choose the total value of the token held in that anyToken.The Multichain incident has puzzled blockchain analysts, as it remains unclear whether it resulted from an exploit or if it was simply large token-holders moving their funds between networks. The mystery began on July 7 when over $100 million worth of tokens were withdrawn from the Ethereum side of Multichain’s bridges and transferred to wallet addresses with no prior transactions. This represented the majority of funds held on each bridge.Hack or rug pullThe Multichain team labeled these withdrawals as “abnormal” and advised users to stop using the protocol. However, they have not disclosed the source or nature of the anomaly. In response to the incident, stablecoin issuers Circle and Tether froze some of the addresses involved in the suspicious transactions. Chainanalysis, a blockchain analytics firm, has commented that the incident appears more like a hack or rug pull rather than a migration.Adding to the complexity, the Multichain team has reported that their CEO is missing, and they have shut down certain bridges due to losing access to some of the network’s multi-party computation network servers. There have been various concerns relative to Multichain since May. The situation continues to evolve, with ongoing investigations and efforts to mitigate any potential damage caused by the suspected malicious activity.

Bybit Extends Service Offering to Include LendingDubai-headquartered crypto spot and derivatives trading platform Bybit announced on Tuesday that it has expanded the range of services it offers to now also encompass crypto lending.Photo by Traxer on UnsplashHourly interestIn the announcement which has been published to the platform’s website, the company set out the nature of the Bybit Lending product. “With Bybit Lending, users can deposit their unused cryptocurrencies into Asset Pools, which will be lent out to borrowers,” the service update outlines.Expanding on the features that the new service offering brings with it, the crypto platform outlines that customers will have the ability to accrue interest on an hourly basis. That interest will be calculated at a variable rate, with a variance in the rate depending upon the level of borrowing activity. “In extreme cases where there are no borrowers at all, the interest rate could drop to 0%,” the company clarified.Low risk claimsBybit points out that “loaned assets are kept safe by Bybit’s strict risk management system, enabling you to earn returns with peace of mind.” While this is comforting to hear, it remains to be seen to what extent crypto market participants will take this statement at face value.2022 proved itself to be a graveyard for most of the leading crypto lending firms, and with that, such failures also proved to be a graveyard for the hard earned funds of retail market participants in their hundreds of thousands. Many are dubious about the integrity and sustainability of the crypto lending model, at least at a retail level.Withdrawal restrictionsBybit added that the product facilitates flexible redemptions. However, in an accompanying note, it added that the withdrawal of funds is dependent upon “ the funds in the Asset Pool [not being] fully lent out and you have not exceeded your Daily Withdrawal Limit.”It’s important to note that as many of the failed crypto lenders were getting further and further into difficulty in 2022, they added more arduous withdrawal limits and withdrawal conditions as a mechanism to stem the bleeding that was the outward flow of deposits against a backdrop of a deficit in customer funds held by these platforms.In further marketing of the product on Twitter, the company is claiming that customers can benefit from interest rates of up to 16.46%. While one could take the view that limited promotion of exceptionally high interest rates is harmless, the lesson learned from recent crypto lender failures is that such platforms were offering excessive and unsustainable interest rates as a mechanism to reel in retail deposits, only to later proceed to mismanage those funds.Competing offeringsBybit is not alone in offering this service. While a plethora of lending services exited the market via bankruptcy, exchanges such as OKX and KuCoin have their own variations on lending. OKX extends a loan facility to platform users proportionate to digital assets the user has deposited on the platform. Seychelles-based KuCoin offers a lending service across a broad spectrum of crypto assets.The intent of US based platforms Coinbase and Kraken in this regard has been retarded due to the actions of US regulators. Kraken fell foul of the Securities and Exchange Commission (SEC) relative to its staking service and paid a $30 million fine as a consequence. Meanwhile, Coinbase shelved plans to launch lending-based services in September 2021 having been warded off the idea by the SEC.

Duncan Chiu, a member of Hong Kong's Legislative Council, has expressed concerns over the stringent regulations imposed on cryptocurrency exchanges by the Securities and Futures Commission (SFC). In an opinion piece for the Hong Kong Economic Journal, Chiu argued that these rigorous standards have deterred major global exchanges from entering the Hong Kong market, undermining confidence in the region's commitment to developing Web3 technologies. He highlighted the recent withdrawal of license applications by prominent exchanges such as OKX, Gate.io and HTX as indicative of the flaws in the current regulatory framework.Photo by Chapman Chow on UnsplashLicensing system and industry developmentChiu criticized the fragmented approach to policy development for Hong Kong’s virtual asset market, noting that various aspects like VATP (Virtual Asset Trading Platforms), stablecoin issuance and virtual asset over-the-counter trading are managed by different departments without strategic industry consideration. He also mentioned feedback from license applicants who feel that the authorities lack a forward-thinking vision for fintech and are applying traditional financial principles too rigidly to the dynamic and innovative sector of Web3. Furthermore, Chiu pointed out the disconnect between the industry and regulators, particularly in the experience required of management in licensed crypto operations versus the practical experience of regulators in Web3, complicating effective communication and progress.