$25 Million In Crypto STOLEN By Hackers... Then Returned!?

Decentralized cryptocurrency loan platform 'Lendf.Me' suffered a security breach earlier this year, around $25 million worth of cryptocurrency was stolen.

The full-geek explanation; an exploit in the DeFi smart contracts, specifically the callback mechanism, enabled the hacker to withdraw ERC777 tokens repeatedly, this exploit allows them to drain the account without the new balance being immediately updated and showing the theft, until it's too late.

Upon discovering this, things couldn't have looked any worse, and the CEO with no choice but to announce the news, publicly made this depressing statement:

"This attack not only harmed our users, our partners, and my co-founders, but also me personally. My assets were stolen in this attack, too. This attack was my failure. While I did not execute it, I should have anticipated it and taken actions to prevent it. My heart goes out to everyone harmed, and I will do everything in my power to make this right. I sincerely apologize to our users, to our new investors, and to my team for letting them down."

While it sounded like the company was down and out, possibly forever - this was actually just the beginning.

The site's CEO Mindao Yang wanted to try negotiating, so he had his team leave a note for the hackers on the blockchain, saying "Contact us. For your better future" along with their direct contact information.

The Counterattack...

Here's where they got it right - instantly their team sprang into action, bringing in security firm SlowMist, which specializes specifically in blockchain-based cybersecurity, along with the Singapore Police.

They then announced on their social media that the process of tracking down the hackers had begun.

While we don't know what (if anything) was left behind as far as clues that could lead to the hackers, the company began a campaign to put them in a state of paranoia, stating on their site that there were 'traces left by the hackers before and after the attack' allowing them to 'cross-check with the resources of various parties at home and abroad to obtain breakthrough clues, getting closer to the hacker'.

At the same time, they began contacting other exchanges and making them aware of the hack, getting them to blacklist, and freeze any wallets receiving the stolen coins. If they can't trade the coins - they're worthless.

The Hackers Couldn't Take The Heat...

The stress was too much, this wasn't going to be the easy payday that they planned on. The combination of a security firm in the process of tracking them down, and the coins becoming hard to spend as more exchanges blacklisted them, led the hackers to decide it just wasn't worth it anymore.

They began returning *some* of the stolen crypto, hoping to meet in the middle and still walk away with some profit. Then, something must have really spooked them - the following day they sent back everything they had left.

Nearly All Of the $25 Million Was Recovered...

While the company stated 'all' the assets had been recovered, we were only able to verify $24 of the original $25 million as being returned. But we won't bother getting hung up on a $1 million loss, compare to how this story started - this is a win.

Any users with funds stolen have been promised 100% will be returned.

The company is now bringing in 3rd party experts to both analyze what went wrong, and what needs to be done to fortify their security in the future.

As for the hackers, and likely part of the deal: the company has withdrawn their request to press charges with the Singapore Police.

------

Ross Davis is the Editor In Chief at the Crypto Press Association, overseeing a global team covering everything related to cryptocurrency and blockchain technology.

Twitter: @RossFM

-------