Tapioca Foundation Loses $4.7M in Hack Targeting Vesting Contract for TAP Token and USDO Stablecoin

Tapioca Foundation revealed the breach in an on-chain message on October 20, directly addressing the attacker. The message contained an appealing offer

On October 18, a phishing attack targeting a co-founder of the Tapioca Foundation resulted in the theft of 591 ETH and $2.8 million in USD Coin (USDC) from the Tapioca DAO Token (TAP) and USDO stablecoin vesting contract. The attacker was able to gain access to the vested TAP tokens and used them to mint an infinite amount of USDO, which was then used to drain liquidity pools containing USDO and USDC.

The Tapioca Foundation revealed the breach in an on-chain message on October 20, directly addressing the attacker. The message included an appealing offer: “We would like to offer you an attractive bounty settlement where you would walk away with funds that are fully legally yours, no strings attached.” The foundation proposed a $1 million bounty in Tether (USDT), which is significantly higher than the typical 10% bounty, in exchange for the attacker returning the remaining $3.7 million.

According to Matt Marino, co-founder of Tapioca, the attack occurred during a job interview, where a co-founder, known pseudonymously as “Rektora,” fell victim to a phishing attack. Marino stated that Rektora unknowingly downloaded malicious software, allowing attackers to alter transactions and take control of key contracts.

However, the Tapioca team managed to partially recover the stolen assets. Marino later announced that Tapioca had “hacked the hacker” and retrieved 1,000 ETH, valued at over $2.7 million, which had been used as collateral for the USDO stablecoin in a liquidity pool.

Following the attack, nearly 30 million TAP tokens were withdrawn from the vesting contract and swapped for approximately $1.5 million in ETH. The attacker then converted the ETH into USDT and moved it to the BNB Chain, where the funds remain, according to on-chain records.

The TAP token, which was trading at around $1.40 before the attack, has since seen a drastic decrease in value, now hovering at just $0.015.

The Tapioca Foundation hacking incident raises questions about the security of decentralized finance (DeFi) protocols and the broader crypto industry. In the past four months alone, the crypto community has faced multiple frauds and hacks, highlighting the need for increased vigilance and robust security measures to protect digital assets.