Cryptohack Roundup: $206M Gala Games Exploit

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Gala Games and Pump.fun were hacked; alleged pig-butchering scammers, Incognito admin and illicit banking racketeers were arrested; Pink Drainer was shut down; the U.S. House approved a crypto bill; a man pleaded guilty to wire fraud; and tech companies formed a scam-fighting coalition.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

A hacker on Monday exploited Web3 gaming firm Gala Games to mint 5 billion crypto tokens worth around $206 million and returned $22.5 million of it the next day.

Gala Games co-founder Eric Schiermeyer, who’s known as “Benefactor,” said that the exploiter sold 600 million GALA, worth about $21 million, and burned the remaining 4.4 billion tokens. The company secured and removed unauthorized access to the GALA contract within 45 minutes of learning about the exploit, he said in a post on X. He also acknowledged internal control failures, adding that the company has taken steps to prevent future incidents. The company froze the affected crypto wallets and is working with the FBI, the U.S. Department of Justice and international authorities to investigate the exploit, he said. Affected users are expected to be eligible for a refund.

Solana-based memecoin launchpad Pump.fun said that a former employee was behind a Thursday exploit that resulted in the misappropriation of approximately 12,300 SOL, valued at about $1.9 million. The ex-employee used privileged access to gain control of the platform’s admin privileges, used flash loans on a Solana lending protocol to buy memecoins, and exploited the bonding curves smart contract to repay the loans and gain liquidity. Pump.fun paused operations and upgraded contracts to prevent further damage, and it said that user contracts remained safe.

Law enforcement arrested two individuals, Daren Li and Yicheng Zhang, for allegedly orchestrating a scheme that laundered more than $73 million through U.S. financial institutions and converted it to Tether, the U.S. Department of Justice said. Li, 41, was arrested on April 12 at Hartsfield-Jackson Atlanta International Airport and Zhang, 38, was arrested on Thursday in Los Angeles.

Li and Zhang allegedly led an international syndicate that laundered funds obtained through pig-butchering crypto investment scams. They supposedly convinced victims to transfer millions of dollars to U.S. bank accounts, which they then allegedly moved to other domestic and international accounts.

Federal prosecutors said that the scammers laundered more than $73 million, moved funds to bank accounts in the Bahamas, and converted them to USDT. A cryptocurrency wallet connected to the scheme received over $341 million in virtual assets.

Li and Zhang face charges of conspiracy to commit money laundering and six counts of international money laundering; each charge carries a maximum penalty of 20 years in prison.

Law enforcement arrested the alleged principal administrator of Incognito Market, an illegal dark web marketplace for crypto-based drug sales, said the U.S. Department of Justice. The marketplace facilitated the global sale of drugs, including cocaine, heroin, methamphetamine, LSD, marijuana, oxycodone, ketamine, MDMA, amphetamine and fentanyl.

A complaint says that Incognito Market accrued $100 million in transactions, $80 million of which was in cryptocurrency, primarily bitcoin and monero. Police arrested the alleged owner, Taiwanese national Rui-Siang Lin, aka Pharoah, at John F. Kennedy International Airport in New York City earlier this month. Lin faces charges including continuing criminal enterprise, narcotics conspiracy and multiple counts of money laundering.

Incognito Market had over 200,000 customers and at least one other employee. It registered customers and vendors and allowed them to transact drugs. Vendors paid a $750 fee to join. The marketplace enabled the sale of significant quantities of drugs and took a 5% fee on purchases. The FBI said that Lin earned millions in personal profits.

The developers of wallet drainer service Pink Drainer, linked to the theft of $85 million in cryptocurrency, said they’re shutting down. In a Telegram message first shared by on-chain sleuth ZachXBT, the developers said: “We have reached our goal and now, according to plan, it’s time for us to retire. After this message’s publication, we will begin winding down all of our infrastructure. All stored information will be wiped and securely destroyed.”

Pink Drainer provided a software kit for cybercriminals to steal crypto assets through social engineering tactics and phishing links. These schemes trick users into signing transactions that drain cryptocurrencies and non-fungible tokens from their wallets. Pink Drainer was part of a broader network of phishing-as-a-service platforms, including Monkey Drainer and Inferno Drainer, where developers collected fees and a percentage of stolen assets as payment.

The U.S. House of Representatives approved a bill on Wednesday that aims to establish a new legal framework for digital currencies in a bipartisan vote of 279-136. It is unclear if the Senate will consider the measure. Supporters of the bill say that it will provide regulatory clarity and promote the growth of the digital currency industry. U.S. Securities and Exchange Commission Chair Gary Gensler warned that the bill could create regulatory gaps and undermine long-standing oversight of investment contracts, thereby posing significant risks to investors and capital markets.

Thomas John Sfraga, aka TJ Stone, pleaded guilty to wire fraud charges in a Brooklyn federal court. U.S. federal prosecutors, said Sfraga promised investors returns of up to 60% within three months through a fake cryptocurrency digital wallet, but he embezzled more than $1.3 million in funds. Sfraga falsely claimed ownership of Vandelay Contracting Corp. and Build Strong Homes LLC. “Vandelay Contracting” is an apparent reference to a “Seinfeld” episode in which character George Costanza claims to have interviewed at Vandelay Industries for a position as a latex salesman. Costanza also used the name Art Vandelay as an alias through the TV series.

Sfraga faces up to 20 years in prison and must pay $1.33 million in restitution.

Chinese police uncovered a $1.9 billion underground banking operation involving the Tether stablecoin that racketeers used to exchange foreign currencies since January 2021. Authorities arrested 193 suspects across 26 provinces, dismantled two operations in Fujian and Hunan and froze 149 million yuan – $20 million – linked to the operations. The Chinese government has banned use of cryptocurrency and bitcoin mining, but locals have found ways to circumvent these restrictions.

Tech companies across social media, dating apps, financial institutions and cryptocurrency industries formed the Tech Against Scams coalition to combat online fraud and financial schemes. The coalition includes Coinbase, Tinder and Hinge’s parent firm Match Group, Meta, Kraken, Ripple, Gemini and the Global Anti-Scam Organization. The coalition, which began last summer, focuses on sharing best practices, threat intelligence and strategies to protect consumers from schemes such as romance scams and crypto frauds such as pig butchering.