Crypto lender Geist Finance shuts down permanently due to multichain hack

Lending protocol Geist Finance is shutting down permanently due to damages caused by multichain exploitation, according to a July 14 social media post from the app’s development team. Geist contracts were halted on 6 July, then resumed on 9 July in “withdrawals and payments only” mode. The latest post confirms that the team is not planning to resume lending and borrowing on Geist.

1/2 Following confirmation from Multichain that funds will not be withdrawn, we are announcing that GIST will not re-open. Because the Chainlink oracles are tracking the value of actual USDC, USDT, WBTC or ETH, they are not aware of the actual value of multichain assets.

— Geist Finance (@GeistFinance) 14 July 2023

Geist is a lending protocol running on Phantom Network. It had over $29 million worth of crypto assets locked in its contracts prior to the Multichain hack. Prior to the hack, Gist allowed users to borrow, lend or use as collateral tokens bridged from the Multichain platform, including USD Coin (USDC), Tether (USDT), Bitcoin (BTC) and Bridged versions of Ether (ETH) included. It used the Chainlink oracle to track the prices of these assets to determine their collateral and loan values.

According to the post, these oracles have stopped providing reliable information. They are now listing values ​​of non-bridged, or “real” versions of each coin, which are more than four times the value of their multichain derivatives, as the team explained:

“Since Chainlink oracles are tracking the value of actual USDC, USDT, WBTC or ETH, they are not aware of the actual value of multichain assets. Those assets are currently trading at about 22% of their true value.

The team said this makes renegotiating loans “impossible”, as doing so would result in bad debt for holders of non-multichain coins such as Magic Internet Money (MIM) or Phantom (FTM). As a result, Geist will not be able to reopen.

Connected: Circle, Tether seize over $65 million in assets transferred from MultiChain

The team clarified that it is not blaming the Chainlink oracles for Geist’s shutdown, as these oracles “worked as they should.” Instead, “No one can be blamed here except @MultichinOrg.”

The Multichain hack was first reported by blockchain analytics experts on July 7. Over $100 million was withdrawn from the Ethereum side of multichain bridges including Dogchain, Phantom, and Moonriver. The MultiChain team called the transaction “unusual” and warned users to stop using the protocol. However, the team refrained from calling it a hack or an exploit.

On July 11, on-chain spy and Twitter user Spreek reported that an unknown person was withdrawing funds from the protocol and using a fee-based exploit to send them to new wallet addresses.

On 14 July, the Multichain team confirmed that the withdrawals from 7 July were the result of a hack. The network was storing all of its private keys in a “cloud server account” under the sole control of the team’s CEO, who was arrested by Chinese authorities. This cloud server account was later accessed by someone and used to withdraw funds from the protocol. team first where did it go The protocol’s documentation states that no single server had access to all parts of the key.

According to a July 14 post, the July 11 fee-based attack was a counter-exploit launched by the CEO’s sister on orders from the Multichain team in an attempt to recover funds. The sister was later arrested, and the status of the assets recovered from her is “uncertain”.