Sonne Finance Cyberattack Leads to Multi-Million Dollar Loss

Sonne Finance, a liquidity market protocol operating on Optimism and Base, has been hit by a significant cyber attack. Blockchain security firm Cyvers detected the attack on May 15 in the early morning of Asia, initially estimating losses of $3 million. However, the situation worsened rapidly, with Cyvers updating the loss estimate to $20 million within 30 minutes. Sonne Finance has acknowledged the incident on Twitter and suspended all markets on Optimism, while markets on Base remain unaffected.

Sonne Finance Suffers Major Cyberattack, Millions Lost

On May 15, the decentralized liquidity market protocol Sonne Finance, operating on Optimism and Base blockchains, fell victim to a significant cyberattack. Blockchain security firm Cyvers detected the incursion in the early morning hours of Asia time.

Initial Breach and Escalating Losses

Cyvers initially reported that $3 million had been stolen from Sonne's USD Coin (USDC) and Wrapped Ethereum (WETH) contracts on its Optimism chain. However, the situation deteriorated rapidly. Within 30 minutes, Cyvers revised the loss estimate to $20 million, triggering an urgent warning to Sonne Finance to take immediate action.

Contracts Exploited and Fake Account Scam

Cyvers identified that Sonne Finance's contracts had been exploited, allowing the attacker to drain digital assets. Approximately an hour after the breach was detected, Sonne Finance acknowledged the incident on Twitter, confirming that markets on its Optimism blockchain had been paused for security purposes.

Meanwhile, BeInCrypto uncovered a fraudulent Twitter account impersonating Sonne Finance and urging users to revoke all approvals to prevent further losses. The fake account shared a suspicious link that purported to check exposure to the exploit and revoke approvals, but the tweet was later deleted.

Crypto Industry Faces Cybersecurity Challenges

This attack on Sonne Finance underscores the ongoing vulnerabilities within the decentralized finance (DeFi) sector. DeFi platforms hold substantial amounts of digital assets, making them attractive targets for cybercriminals. The incident also highlights the importance of implementing robust security measures to safeguard digital assets.

The crypto industry has witnessed a decrease in hacking incident frequency, with a reported decline of over 65% from April 2024 to April 2025. However, the magnitude of losses remains significant. According to the SlowMist Weekly Security Report, crypto-related security incidents resulted in total losses of $71.39 million from April 28 to May 4, 2024.

Separate Incident at BlockTower Capital

In a separate development, crypto investment firm BlockTower Capital reportedly experienced a cyberattack, with undisclosed sources alleging that fraudsters drained a portion of its main hedge fund. The stolen funds remain missing, and the attacker's identity is unknown. BlockTower Capital has hired blockchain forensics analysts to investigate and trace the stolen money. The firm has yet to issue an official statement regarding the incident.

The frequency of cyberattacks targeting the crypto industry continues to be a concern, emphasizing the need for heightened vigilance and the adoption of robust security protocols by companies and investors alike.