{"id":195209,"date":"2021-03-05T22:58:35","date_gmt":"2021-03-05T19:58:35","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/paid-network-exploiter-nets-3-million-in-infinite-mint-attack\/"},"modified":"2021-03-05T22:58:35","modified_gmt":"2021-03-05T19:58:35","slug":"paid-network-exploiter-nets-3-million-in-infinite-mint-attack","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/paid-network-exploiter-nets-3-million-in-infinite-mint-attack\/","title":{"rendered":"# PAID Network exploiter nets $3 million in infinite mint attack"},"content":{"rendered":"<p>&#8220;<strong># PAID Network exploiter nets $3 million in infinite mint attack <\/strong>&#8221;<br \/>\n<img decoding=\"async\" src=\"https:\/\/images.cointelegraph.com\/images\/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjEtMDMvN2NiMjA2NzEtZjI5OC00N2NmLWE1MzItNWM0OGMxMGUxZjg0LmpwZw==.jpg\" \/><\/p>\n<div class=\"post-content\" data-v-5a136f3a>Paid Network, a DeFi platform aimed at real-world businesses, has been exploited today in an \u201cinfinite mint\u201d attack that has sent PAID token prices plunging upwards of 85%.<\/p>\n<p>While the exploit netted nearly $180 million in PAID tokens at the time of the attack \u2014 what would have comfortably been the largest exploit of a DeFi protocol \u2014 the hacker\u2019s payday will end up being far less. One observer noted that the attacker\u2019s <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/etherscan.io\/address\/0x18738290af1aaf96f0acfa945c9c31ab21cd65be\">wallet<\/a> only converted some of their tokens to wr<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ed ether, leaving the rest in rapidly-devaluing PAID tokens:\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Summary of <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24PAID&amp;src=ctag&amp;ref_src=twsrc%5Etfw\">$PAID<\/a> incident:<\/p>\n<p>Total PAID swapped to WETH: 2079.603371141493 <br \/>= $3,104,887.33<\/p>\n<p>Total PAID left in account: 594,717,455.71 <br \/>= $24,313,147<\/p>\n<p>Total amount in attacker account = $27,418,034.33<\/p>\n<p>Stay Safe. <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/t.co\/Lz93qGKAq0\">pic.twitter.com\/Lz93qGKAq0<\/a><\/p>\n<p>\u2014 vasa (@vasa_develop) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/vasa_develop\/status\/1367916592089161733?ref_src=twsrc%5Etfw\">March 5, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>The attacker\u2019s wallet still has over 57 million PAID tokens worth $37 million.\u00a0<\/p>\n<p>The exploit is conceptually similar to an attack on insurance protocol Cover that took place in late December last year. In that instance, the team took a \u201csnapshot\u201d of holders prior to the attack and issued a new token, returning the supply of the token to pre-exploit levels. <\/p>\n<p>The team confirmed on <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">Twitter<\/a> that they are currently planning for a snapshot and restoration:<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">We are investigating the issue. We pulled liquidity, are creating a new smart contract, &amp; will be restoring everyone&#8217;s original balances to before the hack.<\/p>\n<p>Those with staked, Lpool &amp; UniFarm <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24PAID&amp;src=ctag&amp;ref_src=twsrc%5Etfw\">$PAID<\/a> will have their tokens be sent to them manually.<\/p>\n<p>We will share more updates soon<\/p>\n<p>\u2014 PAID NETWORK (@paid_network) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/paid_network\/status\/1367920257202061318?ref_src=twsrc%5Etfw\">March 5, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>However, token holders anxious for a resolution may be out of luck. Some in the community are speculating that the attack on PAID wasn\u2019t an exploit at all, but instead a \u201crugpull\u201d \u2014 a colloquial term for an insider designing contracts to specifically make them exploitable and swiping user funds.\u00a0<\/p>\n<p>Nick Chong of Parafi Capital noted on Twitter that Paid\u2019s deployer contract, an externally controlled account, transferred ownership of the deployer to the attacker shortly before the mint, indicating that a member of the team either rugpulled, or errantly allowed the attack to take place with a security lapse:<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Paid Network&#8217;s deployer, an EOA, transferred ownership of a contract to the attacker 30 mins before the mint<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/t.co\/h14GdV4fCf\">https:\/\/t.co\/h14GdV4fCf<\/a><\/p>\n<p>\u2014 Nick Chong (@n2ckchong) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/n2ckchong\/status\/1367905499585282055?ref_src=twsrc%5Etfw\">March 5, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Additionally, a DeFi risk analysis account @WARONRUGS warned of exactly this exploit in late January, noting that the contract owner can mint PAID tokens at any time:<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">\u274c Scam Advisory #86- PAID Network <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24PAID&amp;src=ctag&amp;ref_src=twsrc%5Etfw\">$PAID<\/a> (0x8c8687fC965593DFb2F0b4EAeFD55E9D8df348df)<\/p>\n<p>Reason: The owner can mint tokens and did mint tokens to fresh wallets who never bought the presale. Contract is behind a proxy.<\/p>\n<p>Likeliness of losing all funds: Very High<\/p>\n<p>DYOR. <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/hashtag\/WARONRUGS?src=hash&amp;ref_src=twsrc%5Etfw\">#WARONRUGS<\/a>\u274c <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/t.co\/YQunjpWuxY\">pic.twitter.com\/YQunjpWuxY<\/a><\/p>\n<p>\u2014 #WARONRUGS\u274c (@WARONRUGS) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/WARONRUGS\/status\/1353771974506459138?ref_src=twsrc%5Etfw\">January 25, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>An on-chain note sent to the attacker has <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/etherscan.io\/tx\/0x9923b60fc0ddda404092b34b47a2d0a8e1b87696228931119ff5846637479600\">ominously<\/a> warned that \u201cthe LAPD will be in contact with Kyle Chasse very shortly.\u201d Kyle Chasse is the CEO of Paid Network.<\/p>\n<p>Paid Network did not respond to a request for comment by the time of publication.\u00a0<\/p>\n<p><template data-name=\"subscription_form\" data-type=\"defi_newsletter\"><\/template><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong>\n<\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a> articles, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/general\/\" target=\"_blank\" rel=\"noopener\">General category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/cointelegraph.com\/news\/paid-network-exploiter-nets-3-million-in-infinite-mint-attack\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;# PAID Network exploiter nets $3 million in infinite mint attack &#8221; Paid Network, a DeFi platform aimed at real-world businesses, has been exploited today in an \u201cinfinite mint\u201d attack that has sent PAID token prices plunging upwards of 85%. While the exploit netted nearly $180 million in PAID tokens at the time of the&#8230;<\/p>\n","protected":false},"author":1,"featured_media":195210,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/images.cointelegraph.com\/images\/1200_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjEtMDMvN2NiMjA2NzEtZjI5OC00N2NmLWE1MzItNWM0OGMxMGUxZjg0LmpwZw==.jpg","fifu_image_alt":"","footnotes":""},"categories":[1],"tags":[74868,74891,74882,74892],"class_list":["post-195209","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-defi","tag-ethereum","tag-hacks","tag-tokens"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/195209","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=195209"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/195209\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/195210"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=195209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=195209"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=195209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}