Crypto Broker DeltaPrime Drained of Over $6M Amid Apparent Private Key Leak

Election 2024 coverage presented by
Over $6 million worth of various tokens from wallets belonging to on-chain brokerage DeltaPrime were drained early Monday after an apparent private key leak, security researchers said on X.
The project is offered on both Arbitrum and Avalanche blockchains. Monday’s exploit impacted only the version on Arbitrum as of European morning hours – and users could not withdraw funds (on Arbitrum) due to how the utilization of borrowing and lending works on the platform.
A hacker gained control of 0xx40e4ff9e018462ce71fa34abdfa27b8c5e2b1afb, which is the admin of proxies. Then, the hacker upgraded the proxies to point to malicious contract 0xD4CA224a176A59ed1a346FA86C3e921e01659E73, Fuzzland founder Chaofan Shou said on X.
Proxy is a contract that interacts with users and other contracts. It contains minimal logic and serves as an intermediary, but it is a key part of any application, as a compromise can mean the entire protocol is impacted.
Security firm Cyvers confirmed the exploits in a Telegram message to CoinDesk, stating tit detected “multiple suspicious transactions” involving Delta Prime and that it “seemed that admin has lost the private key.
“Affected pools so far are the #DPUSDC, #DPARB, #DPBTCb,” Cyvers said, referring to on-chain lockers holding USDC stablecoins, Arbitrum’s ARB and bitcoin (BTC).
Messages sent by Delta Prime team members on its Discord channel viewed by CoinDesk said the team was investigating and working on the issue. They did not outright confirm or announce the exploit or reveal specific details as of European morning hours.
DeltaPrime’s PRIME tokens are down 6.5% in the past 24 hours, tracking a market-wide drop led by ether (ETH).
Edited by Parikshit Mishra.
Disclosure
Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.
Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.