KyberSwap, the number one multi-chain decentralized exchange(DEX) aggregator and liquidity source suffered an attack on it’s TVL pool, tanking it by almost 70% in the late hours of 22nd November,2023.

The Kyberswap team took to X in a post on their official X handle @KyberNetwork on 23rd November 2023 to say.

‘ 🚨Urgent🚨

Dear KyberSwap Elastic Users,

We regret to inform you that KyberSwap Elastic has experienced a security incident.

As a precautionary measure, we strongly advise all users to promptly withdraw their funds. Our team is diligently investigating the situation, and we commit to keeping you informed with regular updates.

Thank you for your understanding and cooperation during this challenging time.

KyberSwap's aggregator is not impacted and is operating fully as normal.’

As stated by the Kyberswap team, the TVL pool was the only affected area and as the message circulated, the TVL tanked, and to a further $78Million left the protocol according to defiLama reports. This was once a TVL with a peak of $134Million this same year 2023, now merely a $27Million left as reported last month.

Now if you ask me, just my opinion yeah, I’d say this hack was properly thought out and orchestrated almost like the person behind it was giving us the impression He knew exactly what he was doing, maybe not? what do I know. I’ll tell you something new nonetheless.

According to Debank data, around $46 million has been transferred out in the attack, including roughly $20 million in Wrapped Ether (wETH), $7 million in wrapped Lido-staked Ether (wstETH) and $4 million in Arbitrum (ARB).

The funds were split across multiple chains, including Arbitrum, Optimism, Ethereum, Polygon, and Base.

After the hack, the person behind it sent an on-chain message stating;

‘ Dear Kyberswap Developers, Employees, DAO members, and LP’s.

Negotiations will start in a few hours when I am fully rested.

Thank You ‘.

This same DEX reported a hack back in April 2023, same elastic protocol even though no user funds was stolen then but the team still went on to quickly announce on their official X account for users to withdraw funds immediately and wait for a notification as to when a new smart contract is deployed. As that wasn’t enough, September was another hit on the DEX, this time a $265,000 worth of crypto was stolen. a bounty of 15% was offered by the DEX to the hacker to return the stolen assets as it was cited, there was nowhere to run. Apparently, the hacker’s wallet had been traced down to a centralized exchange where he could be identified if investigated further so I guess that wasn’t a good hit.

I’m sure you’re thinking… ‘So what exactly happened? ‘ Haha... Of course, the hacker was caught after two hours of proper investigation. Now even though this happened, I like to believe the brain behind these previous hacks is still the one behind this current one, which is the more reason I think it might be an inside job. When something happens once, a mistake perhaps, twice? A coincidence maybe? But thrice? That's consistency I tell you, all in a year. You can see the same patterns I see right? I'll tell you why I think so.

From on-chain messages sent across, it's understood that the hacker wants to negotiate and return funds. After the first on-chain message sent in by the hacker, kyberswap execs suggested a deal where the hacker was to return 90% of the stolen funds and keep 10% for themselves. Seeing as the hacker decided he was going to take a break to rest, there was no response from his end. Kyberswap execs then threatened to take legal actions and create a bounty program, which only led to the next on-chain reply from the hacker on the 28th day of November stating;

‘ Dear Kyberswap Executives, Employees, Token Holders and LPs,

I said I was willing to negotiate. In return, I have received (mostly) threats, deadlines, and general unfriendliness from the executive team. That's ok, I don't mind.

I have prepared a statement concerning our (potential) treaty. I plan to release it on Nov. 30 at Noon UTC, sharp.

Under the assumption that I am treated with further hostility, we can reschedule for a later date, when we all feel more civil. You need only say the word.

If not, we proceed as planned on Nov. 30.

Thank you. ‘

Seeing this reply, I'm sure any wise businessman wouldn't wanna pressure on any further. My guess was right or not? But the next on-chain reply came on the 30th day of November 2023 at noon as promised by the hacker. He even keeps to time, just something to note, I'm sure it's probably nothing haha… ;

‘ To ALL relevant and/or interested parties,

I thank you for your attention and patience during this uncertain time for Kyber (the protocol/DAO) as well as Kyber (the company). Below I have delineated a treaty for us to agree to.

My demands are as follows:

* Complete executive control over Kyber (the company)

* Temporary full authority and ownership over the governance mechanism (KyberDAO) in order to enact legislative changes. My current wallet address is fine for this.

* All documents and information related to company / protocol formation, structure, operation, revenues, profits, expenses, assets, liabilities, investors, salaries, etc.

* Surrender of all Kyber (the company) assets. This is both On-chain and Off-chain assets. It includes but is not limited to: shares, equity, tokens (KNC and non-KNC), partnerships, blogs, websites, servers, passwords, code, social channels, any and all creative and intellectual property of Kyber.

Once my demands have been met, I will provide the following:

* Executives, you will be bought out of the company at a fair valuation. You will be wished well in your future endeavors. You haven't done anything wrong. A small error was made, rounding in the wrong direction, it could have been made by anyone. Simply bad luck.

* Employees, under the new regime your salary will be doubled. It is understandable that many current employees will want to leave regardless. The employees who don't want to stay will be given a 12-month severance with full benefits and assistance in finding a new career, no questions asked.

* Token Holders and Investors, under this treaty, your tokens will no longer be worthless. Is this not sweet enough? I'll go further still. Under my management, Kyber will undergo a complete makeover. It will no longer be the 7th most popular DEX, but rather, an entirely new cryptographic project.

* LPs, you will be gifted a rebate on your recent market-making activity. The rebate will be for 50% of the losses you have incurred. I know this is probably less than what you wanted. However, it is also more than you deserve.

This is my best offer. This is my only offer.

I require my demands to be met by December 10, otherwise, the treaty falls through.

Additionally, should I be contacted by agents from any of the 206 sovereignties, concerning the trades I placed on Kyber, the treaty falls through. In this case, rebates will total to exactly 0.

Kyber is one of the original and longest-running DeFi protocols. No one wants to see it go under.

To assist with this transition of leadership, I may be contacted on telegram: @Kyber_Director

Thank you. ‘

- Kyber Director

Transaction hash;

Now tell me, what do you think about this?

Am I alone this time?

As always, your favorite Crypto journalist - Clever Abaribote.

Writer and Editor : Clever Abaribote.

Sources:

Cointelegraph, Cryptoslate, Debank, DefiLama.

Link to the KyberSwap official X post;

https://x.com/kybernetwork/status/1727475235342217682?s=46

Link to the Transaction hash ;

First - https://etherscan.io/tx/0x5c27d8e9248608f36b028a945f3d6ff31244ab45eb89e1d1a631f608a36454a1

Second - https://etherscan.io/tx/0x0479da9d6a3a29b294d6337630ea0a482e7ec7223f3b6e6d72442f6c450264d4