Hacker releases a quadrillion MAPO cryptocurrency tokens

The hacker exploited a vulnerability in the Solidity program code in the MAP protocol, releasing about a quadrillion MAPO tokens to his own address. This was reported by Blockaid analysts. According to them, the attack became possible due to an error in the message verification logic: the attacker sent a fake request for a repeat transaction, which the bridge recognized as legitimate. As a result, the smart contract issued a number of tokens that was about 4.8 million times higher than the entire legal market turnover. The project keys were not compromised.

After the attack, the price of the native MAPO token plummeted by 96% to $ 0.9 in a few hours. Subsequently, the quotes partially recovered and reached $ 0.002, but the total daily drop was still more than 30%, according to CoinMarketCap and CoinGecko.

The attacker managed to sell about 1 billion MAPO through Uniswap liquidity pools, receiving 52 ETH worth $ 110,000 in return. However, according to Blockaid, the hacker’s wallet still contains about a trillion MAPO tokens. Blockchain security experts warn that this poses a real threat to liquidity on other trading platforms.

The MAP Protocol team has shut down the main network and token conversion service. The developers have migrated to a new smart contract — the relevant information is already displayed on CoinGecko. The project has promised to take a snapshot of users' balances to correctly distribute new assets, and to cancel tokens on the attacker’s addresses.

Users are strongly advised to refrain from exchanging MAPO via Uniswap and ignore any messages from the project’s support team.

Meanwhile, the cryptocurrency market has faced another security incident: RetoSwap, an anonymous p2p exchange specializing in trading the private cryptocurrency Monero (XMR), has also been hacked. The attackers stole 7,000 XMR worth about $ 2.7 million.