- October 14, 2021,
a day that started like
any other for the crypto platform "Indexed Finance"
ended in total disaster and embarrassment.
In one of the world's biggest cyber attacks, $16 million worth
of cryptos were stolen in the blink of an eye.
Shocked that funds were stolen match from right under
their noses, the founders took immediate action, searching for
any clues they could find on the attacker, hoping
to catch the thief before more harm was done.
However, news of the hack was rapidly spreading.
This meant investors began pulling out their money.
The founders needed to find an
answer before the entire fund collapsed.
How this hack happened is not only insane, but
The worlds of crypto and DeFi are
used to hacks and security breaches.
Ronin, Poly Network, Coincheck these are
just some of the most well known heists
and hackers are only getting more audacious.
These could be troublemakers trying to get rich quick,
secret groups working for a foreign government,
or even real life supervillains just being bad
for the thrill of it.
According to Forbes, the crypto theft industry, if
you want to call it an industry, is
estimated around $10 billion a year.
And that number is only expected to grow.
Now, back to the catastrophe at Indexed Finance.
What is it exactly?
Well, in traditional finance, there are those who
want to invest but don't want the hassle
of buying and selling or tracking individual investments.
Because, believe it or not, some
people have social lives, not me.
But some people don't want to
worry about their investments every day.
For those people, there are ETFs, essentially a basket of
assets like stocks or bonds that you can invest in.
These same styles of funds exist
in the world of crypto.
Crypto ETFs are funds that track a
range of several digital tokens and currencies.
This is what Indexed Finance is a platform
for the Ethereum network that creates tokens representing
baskets of other tokens.
So you get less hassle and diversify your risk,
a casual trader's dream.
Unless your hard earned portfolio
is involved in the world's strangest crypto heist.
Now, if you're an investor looking to protect yourself, one
of the easiest things to do is just keep a
close eye on your portfolio so you know what's going on,
which is easier said than done in crypto.
Because of this, today's sponsor is a platform that
I personally use to track my crypto, CoinStats.
With CoinStates, you can track everything from
crypto on exchanges to DeFi wallets, all in
one easy to use platform.
They have a free version and a
paid version if you're an advanced user.
Plus, the link in the description will give you
a nice, healthy discount on the advanced membership.
Indexed Finance, like many ETFs, is passively managed.
Instead of a person making buying
and selling decisions, there's this algorithm
that ensures that portfolios are balanced.
So let's say a portfolio is supposed to be 20% Bitcoin.
If Bitcoin surges in price, meaning
it's now 25% of the portfolio.
An algorithm will help balance this back down to 20%.
But this doesn't happen through
your typical buying and selling.
Indexed Finance simply creates incentives for its
users to buy and sell for them
through small arbitrage or profit opportunities.
This means that they can actually rebalance a
basket without ever accessing any external market.
Sounds like a pretty awesome idea.
Sounds pretty revolutionary.
An index fund where users can
essentially be paid to manage it.
But this cool idea ended up being a vulnerability.
A hacker was able to exploit the way
that these pools were rebalanced, allowing them to
pull out massive amounts of cash.
At 6:37 PM,
on October 14, two index pools were
attacked and consequently drained of their assets.
The hacker started by taking
out a $157 million flash loan.
This is an uncollateralized loan that must
be returned within a few seconds. It's insane.
Within that time, he was able to spend $109 million
buying the Sushi token in one of the pools.
This caused the price of that token
within the pool to skyrocket 860 X.
Now, remember how the pool incentivizes users if
one token in the pool makes up too
much of the weight of the overall portfolio?
Well, that's exactly what happened.
Because the hacker was able to make one token
worth so much within that pool, he was able
to then buy up the pool for pennies on
the dollar before eventually swapping the coins and cashing
out with over $16 million in profits.
As a result, in a matter of hours, the pools
that he attacked lost 85% and 98% of their value.
Of course, investors started asking
questions and then demanded compensation.
While the developers probably wanted to walk into
the ocean or at least stick their heads in the sand,
they had to take action.
But what could they do?
After a deep breath, the team rolled up
their sleeves and started digging for clues.
They needed to find out who did this.
There could be a way to save it
if they could just find out who.
They started to notice something a little bit funky.
About a month before the attack, the core
members were contacted by an anonymous user.
This mystery person reached out under the
nickname UmbralUpsilon, later renamed to BogHolder
Nicknames aren't their strong suit.
BogHolder was asking questions about the reweighting
and reindexing mechanism within their index pool.
In retrospect, this seems insanely suspicious, as this
is exactly how the hacker game the system.
Unfortunately, though, the developers answered
every question the hacker asked
without sensing any danger whatsoever.
In fact, the developers were so flattered that someone
was interested in their product that they started working
with him on some new innovations for the funds.
They even paid him $2,000 for his contributions.
I mean, after all, everything they used
at Indexed Finance was open source.
They were happy to collaborate.
Well, right after the attack, all
of BogHolder's messages were canceled.
Suspicious, it couldn't just be a coincidence.
Without yet knowing the identity of the attacker,
but having strong suspicions, the founders made a
proposition that they thought he couldn't refuse.
They wrote a public message complimenting the
hacker and suggesting he keeps 10% of
the score as a white hat reward.
Now, this might sound odd, but since this corner
of the financial world has little to no regulation,
sometimes the only option is to appeal to the
good faith and egos of the hackers.
Remember the Poly Network hack?
In that case, the bold hacker drained
over $600 million from the platform, one
of the biggest heists in history, period.
But strangely enough, afterwards, the hacker came forward
and engaged with the victims, explaining the vulnerability
that he exploited before eventually returning all the
money back to its rightful place.
Think Robin Hood on an ego trip.
However, Indexed Finance didn't have the same luck.
So what did they do?
They called in law enforcement.
But in order to be effective,
they needed to have a name.
Seemingly stuck in a dead end,
they finally got a break.
They received a lucky tip from someone on Discord.
Apparently, BogHolder participated in one of these
hacking contests hosted by the platform C4.
Being that he's a decent coder,
he actually won a prize.
So right away, they got in touch with
the C4 organizers, and it turns out
the Ethereum wallet related to the attack was
the same one associated with the coding competition.
Finally, they were getting somewhere.
This wallet actually led them
to the hacker's GitHub profile.
And nothing.
A dead end.
So they searched the username on the account mtheorylord1.
Remember, egos.
And they found a second GitHub account.
This one had a code snippet.
That doesn't look like much at first, but when you
look closely, it actually contains a student email address.
This email led them to a forum post where
the hacker states that he has a master's degree
in math and is looking at getting his PhD.
They're getting somewhere.
The trail is getting hot.
After some more searching, they found the hacker, Andy Medjedovic,
an 18 year old from Ontario, Canada. 18.
No s**t.
They were shocked and probably kind of impressed
that this 18 year old, who actually has
a Masters in math hacked their system.
Not your typical frat bro.
Now, considering the generosity of that 10% offer,
the age of the criminal, and the fact
that his identity is known, you would expect
everything just to get resolved, right? No. Wrong.
Immediately, the developers removed that 10% white hat
bounty and contacted Andy on Twitter.
Their message, give back the money now or go to court.
And the 18 year old hacker responded about exactly
how you'd expect, essentially telling them to f** off.
The teenager didn't deny the attack at all
and had zero intention of giving anything back.
In fact, he actually mocked the victims and gloated
that there was nothing they could do about it,
because, heck, that's just the way the cookie crumbles
in the world of crypto. Being the adults in
the room, the founders tried to negotiate with him,
but instead of relenting, he just started posting odd
poems, talking about frogs and God and other nonsense
unimpressed by his frog games.
On December 9, Indexed Finance filed a class
action lawsuit against the 18 year old.
Like any good heist movie, this is one of those
cases that just gets more twisted the deeper you get.
According to Bloomberg, the judge issued a search
warrant for the hacker's house in Ontario.
When the police arrived, they found
his family, but no Andy.
He was gone, taking his computers
and all potential evidence with him.
Now, of course, his parents had no idea where he was.
We have a runaway teen on our hands,
and the plot only thickens from here.
Next, in December that same year, Medjedovic voluntarily
participated in a virtual hearing via Zoom.
He was maybe abroad or in
a basement somewhere in Canada.
Nobody really knows.
He spoke very little and had
his camera off the whole time.
The judge was completely unimpressed and ordered him to
appear in court in Ontario at the next hearing.
But of course, he didn't show up, forcing
the authorities to issue an arrest warrant.
All the while, he's been pretty active on Twitter
saying that he was recruiting some of the top
crypto lawyers in the world for this case, and
he was ready to fight to the death.
But how on earth does he expect to defend himself?
He stole $16 million.
Well, apparently, he's using the "Code Is Law" principle
as his defense, which is stirring up
a whole lot of debate.
Essentially, this principle means that whatever can be
done with coding, consequently, is ethical and legal.
Basically, there's no morals in ones and zeros.
In an unregulated sector, the
code is considered ultimate authority.
So according to him, what he did
wasn't a hack or fraud at all.
There was a system that had a weakness, and
he simply used it to make some money and
take that money from a lot of other people.
But does he actually have a chance in court?
- So if you want to make more money and
keep the money that you make, better call Saul.
- The American legal system is one that's based
on precedents or common law, and these legal
precedents are used for future decisions within court.
So a case like this could really shake things up.
According to many lawyers, the idea that code is law
is destined to fail at some point.
Think of it this way.
Let's say there was a principle called action is law.
Under this principle, if you happen to find a door
to a bank open, you could just go inside and
grab some cash, and you'd be free and clear.
Or if you saw an unintended bike, you can
just jump on it and take it away.
There would be a whole lot of poor bankers
walking home, but it just wouldn't make much sense.
That's why many lawyers say that his
defense simply won't hold up in court.
But there's more to this.
The legal system doesn't just
punish action, but also intent.
This is why someone could be put in
jail for attempted robberies or attempted murders.
In the case of Andy Majedovic, it could
be proven that he had a malicious intent behind
his actions, starting from the fact that he'd gotten
in touch with his target ahead of time to
learn more about their system, to then exploit it.
As we wait and see how this
trial turns, another potential problem worth investigating
is the corporate structure itself.
Indexed Finance is a decentralized autonomous organization, or
a DAO, so it's key decisions are made
by the holders of the governance token NDX.
So far,
So we don't know how this will play
out in terms of ownership or liability.
And meanwhile, what happened to our boy
Andean and his boatload of stolen cash?
Nobody knows where he is.
Some think he's hiding abroad.
Some think he's gone underground.
Maybe he's just back in his parents' basement
under the floorboards with strong WiFi.
We really don't know.
In one of his last public comments, he told
Bloomberg that he doesn't believe in spending money before
allegedly trying to launder $400,000 through a mixing service.
Regardless of what he does with all this dough,
he will surely go down in history as orchestrating
one of the strangest crypto heights the world has
ever seen and creating new legal precedents from here.
I highly recommend checking out
our members only group, Finova.
There you can find all of my investments
daily coaching, trade signals, giveaways all the time.
And you know what?
I'll just show you some of our members profits.
Grab that link to join in the description below.