- Developers deployed a cBTC attack from the main address of the protocol’s native token
- Sonne wBTC was used to exchange all of the liquidity supplied by users to Kokomo
- Kokomo’s website and all of its social media have been deleted
Developers behind lending protocol Kokomo Finance, which is based on Optimism, manipulated tokens in what turned out to be an ingenious exit scam, making away with $4 million in user funds, CoinDesk reported.
Similar to a rug pull, an exit scam happens when the promoters or developers of a crypto platform launch a legitimate-looking project to interested parties, then deplete it of any liquidity attracted. They erase their whole presence once they have drawn a substantial amount of money to the platform, both offline and online.
Attack was deployed using wrapped BTC
The very recently launched Kokomo Finance enabled users to lend, trade, and borrow ether, wrapped Bitcoin, tether (USDT), DAI, and USD Coin. It gained popularity on Optimism rapidly.
According to security company CertiK, the developers deployed a cBTC attack from the main address of the protocol’s native token, KOKO, via a malicious contract. They fixed a reward speed, put a pause on borrowing, and deployed the contract to interact with the platform.
Protocol tricked into believing it had liquidity
cBTC is a wrapped BTC derivative that runs on the Ethereum Mainnet. In this case, it was issued to make Kokomo believe it had liquidity when, in fact, it didn’t.
The cybercriminals used a second developer address to approve a large transfer of another BTC derivative on Ethereum, Sonne wBTC. They then used the tokens to exchange all of the liquidity supplied by users to Kokomo, which exceeded $4 million.
Kokomo disappeared into thin air
Kokomo’s website and all of its social media were deleted soon after the attack. KOKO tokens have lost almost all of their value.
This attack is the most recent in a series of growing exploits and attacks in the crypto market. Euler Finance lost $200 million in an exploit earlier this month.
