Loopring, an Ethereum ZK-Rollup protocol, announced on June 9 that some of its smart wallets were exploited for an undisclosed amount.

Following this news, Loopring’s LRC token dropped by about 4%, reaching a four-month low of $0.21, according to CryptoSlate's data.

$5 Million Lost

Blockchain security firm Cyvers Alert reported that approximately 1,373 ETH, valued at $5 million, were stolen in the breach.

Loopring had previously touted its smart wallets as the “most secured wallets” on the Ethereum blockchain due to their advanced security measures against asset theft.

However, the firm explained that its two-factor authentication (2FA) service was compromised, enabling the attacker to initiate a recovery process, reset ownership, and withdraw assets. Loopring stated:

“The attack succeeded by compromising Loopring’s Two-Factor Authentication (2FA) service, allowing the hacker to impersonate the wallet owner and gain approval for the Recovery from the Official Guardian. Subsequently, the attacker transferred assets out of the affected wallets.”

Meanwhile, Loopring is working with blockchain security firm SlowMist to investigate the 2FA compromise. The team has temporarily suspended Guardian and other 2FA-related operations, adding:

“Loopring is working with law enforcement and professional security teams to track down the perpetrator. We will continue to provide updates as soon as the investigation progresses.”

Smart Wallets

This breach comes at a time when smart wallets are gaining popularity in the Ethereum community.

Over the past year, support for smart wallets has surged following the Ethereum Foundation’s ERC-4337 account abstraction going live on the Ethereum mainnet. This technology allows users to customize their digital asset management.

Prominent figures like Vitalik Buterin and organizations like Coinbase have supported this technology, which is expected to be part of the upcoming Pectra hard fork.

However, decentralization advocate Chris Blec noted that the Loopring incident shows that “smart wallets are not ready for prime-time,” advising users to “stick with properly-secured seed phrases for maximum safety and sovereignty.”

Similarly, Pratik Kala, Head of Research at Liquid Digital Assets, commented:

“Smart wallets are the rave [at the moment] but new attack vectors come with new tech. We’ll get over it over time but be safe and use hardware wallets for [significant assets].”