ParaSwap “Investigating” Possible Private Key Hack

ParaSwap confirmed it was investigating the incident. 

ParaSwap Investigating Address Issue 

ParaSwap may have suffered a hack, blockchain security firm Supremacy Inc. has reported. 

1/ Hi @paraswap ,I heard that you want to see this? your deployer address private key may have been compromised (possibly due to Profanity vulnerability) and funds have been stolen on multiple chains.https://t.co/ijHaTwAj0l

— Supremacy Inc. (@Supremacy_CA) October 11, 2022

Supermacy Inc. first alerted ParaSwap to an issue in a Tuesday tweet storm. “Your deployer address private key may have been compromised (possibly due to Profanity vulnerability),” the warning read. “Funds have been stolen on multiple chains.” 

ParaSwap was quick to respond to the posts, confirming that it was looking into the incident. “We’re investigating, but the address has no power after the deployment. Just paid the gas and retired. Profanity addresses usually have trailing zeros,” the team wrote. 

Supremacy Inc. included an Etherscan link to ParaSwap’s deployer contract address, which holds over 1.8 billion PSP tokens. Etherscan’s transaction history data shows that someone with access to the wallet made several transfers across Ethereum, BNB Chain, and Fantom earlier this morning, though they only withdrew a few hundred dollars in each transaction. Notably, the ParaSwap team did not confirm that it made the transactions in its response, nor did it deny any vulnerability. 

Several members of the crypto community weighed in on Supremacy Inc.’s post shortly after it went live. “Still not as bad PR as the airdrop,” said UpOnly co-host Cobie, referring to ParaSwap’s divisive 2021 token airdrop, which used a strict distribution model that excluded many loyal users. PSP suffered shortly after the airdrop and never recovered; it’s about 98.8% short of its all-time high today. 

This story is breaking and will be updated as further details emerge. 

Source