Update (Dec. 20 at 16:31 pm UTC): This article has been updated to add Aurory’s team response about the incident.
Solana-based gaming ecosystem Aurory was reportedly breached on Dec. 17, resulting in a drop of nearly 80% in liquidity of the AURY-USDC pool on the decentralized exchange (DEX) Carmelot.
According to unconfirmed reports on X (formerly Twitter), the exploit targeted Aurory’s SyncSpace bridge on Arbitrum's native DEX Camelot around 13:00 UTC, reducing the liquidity of the AURY-USDC pool to roughly $312,000 from $1.5 million.
SyncSpace acts as Aurory's bridge, allowing users to switch items between on-chain and off-chain with a single transaction. It enables assets earned in-game that are initially off-chain to be moved to the blockchain when the user chooses to DeSync them.
In a blog post introducing the feature in October 2022, Aurory's team deemed a cross-SyncSpace hack impossible since the technology requires signatures to Sync/DeSync assets.
In a thread on X, Aurory's team member Tim explained that tokens belonging to the team were stolen and immediately sold. "We've been buying back the tokens as we're investigating what happened," he said, adding that a post-mortem would be released after an audit is completed.
In messages sent to Cointelegraph, Aurory's team clarified that a vulnerability in the marketplace endpoint allowed the exploiter to withdraw more tokens from a wallet funded by the team than they should have been able to. “Absolutely zero user deposits were taken due to the way we've built our infrastructure which requires them to approval a signature from their own wallet in order to withdraw assets from their account.”
AURY is trading at $1.23 at the time of writing, 11% down in the previous 24 hours. The attack knocked the token price to $1.13. "The exploiter oppenheimer'd the chart, bottom buyers did 5x in 45m and now the whole pool is whack with very little liquidity," a user wrote.
The weekend was marked by other security incidents affecting the crypto industry. On Dec. 16, trading platform NFT Trade experienced an exploit in two of its old smart contracts, allowing nonfungible tokens (NFTs) worth nearly $3 million to be stolen. The majority of the tokens were returned after a 10% bounty was paid to the attacker.
Magazine: NFT Creator: Pudgy Penguins GIFs top 10B views, CEO sets sights on Disney, Hello Kitty
