There may be good news on the horizon for the victims of one of DeFi\u2019s largest-ever exploits.\u00a0<\/p>\n
At 5:30 AM UTC today, a Meerkat Finance developer identifying themselves as \u201cJamboo\u201d posted a short message in a newly-created Telegram channel, \u201cMeerkatrefunds.\u201d In it, Jamboo said that the exploit was a \u201ctrial\u201d testing user’s greed and \u201csubjectivity,\u201d and that the team was preparing to refund all victims. <\/p>\n
Jamboo provided proof of their association with Meerkat by sending a small transaction from the Meerkat deployer, demonstrating that they have access to the exploited contract (or communicates with someone who does). The transaction was processed on the Binance Smart Chain network roughly twenty minutes after Jamboo\u2019s Telegram post. <\/p>\n
Meerkat was a yield vault project that forked Yearn.Finance\u2019s code \u2014 one of many forks of Ethereum-native protocols that populate BSC. The attack on Meerkat initially took place on March 4, one day after Meerkat’s launch, resulting in a loss of 73,000 BNB and $14 million of stablecoin BUSD \u2014 a total of $31 million in user funds. <\/p>\n
Members of the community were quick to label the exploit as a \u201crugpull\u201d \u2014 a colloquial term for when an insider or a member of a development team exploits a contract using specialized permissions \u2014 given that the Meerkat deployer contract was updated to allow the vaults to be drained shortly before the attack. <\/p>\n
Some thought that the exploit would be a test of Binance Smart Chain\u2019s claim to decentralization. BSC is run by a network of 21 validator nodes, many of which are thought to be associated with or run directly by Binance.\u00a0<\/p>\n
Likewise, the exploit put the attacker in a difficult position: Binance controls on-offramps to BSC, meaning any stolen funds were locked on the chain and impossible to realize as profits.\u00a0<\/p>\n
Attention now turns to the Meerkat developers and their motivations. Jamboo\u2019s message was short on specifics, and contained only vague references to what instigated the team to steal $31 million from users. Jamboo wrote that the team \u201cinvited a third party (hacker) to attack the vulnerability through the verify proxy contract,\u201d and that a full report on the exploit will be forthcoming.<\/p>\n
According to Jamboo, the theft was a demonstration of the avarice that pervades DeFi.<\/p>\n
DeFi is essential, but it has a lot of flaws. It is flourished by human greed.<\/p><\/blockquote>\n