Polygon Protocol QiDAO Exploited, At Least $13M in Crypto Stolen

QiDAO, the native stablecoin protocol on Polygon blockchain, has become the latest target of hackers as its Superfluid vesting contract leading was exploited on Tuesday morning, the developers confirmed.

The protocol allows users to move on-chain assets in a real-time constant flow from one wallet platform to another. It is to be noted that the hackers exploited a vulnerability on the Superfluid fluid code and did not breach the security of QiDAO.

Today at 6.48am GMT, we were notified of a potential exploit of the QiDAO vesting contract that leverages Superfluid code. We are investigating the incident and will keep you updated in this thread and our Discord server.

— Superfluid (@Superfluid_HQ) February 8, 2022

User Deposits Are Safe

The protocol developers further confirmed that the user funds on the platform are safe, and no funds on QiDAO have been affected. However, as a precautionary measure, QiDAO had temporarily paused its bridge and is resolving the issue.

The hackers were successful in siphoning $20 million worth of cryptocurrencies, including 24 wETH, 562,000 USDC, 44 SDT, 1.5 million MOCA, 23,000 STACK and nearly 40,000 sdam3CRV. However, according to crypto analytics group SlowMist’s fund tracker, only $13 million worth of cryptocurrencies were stolen from the platform.

Though the developers are yet to provide any conclusive report on the attack, early investigation suggests that most of the siphoned funds belonged to some of the early backers in the project and also include team vested tokens.

But, most of the dent in the project was faced by the price of the project’s governance token, QI, as it dropped around 65 percent. The hackers dumped the stolen QiDAO on Quickswap DEX, taking the governance token price to as low as $0.18 apiece. But the Polygon community jumped in to buy the dip and pulled the price to $0.6.

Meanwhile, DeFi protocols have become the primary target of hackers due to the vulnerability of these platforms. Wormhole Portal was recently hacked as hackers stole $320 million in wrapped Ethereum, making it one of the largest cryptos hacks to date.