Miners trick stablecoin protocol PegNet, turning $11 into almost $7M hoard

On Tuesday morning, a group of rogue miners on PegNet, a decentralized stablecoin project built on top of the Factom protocol, tricked PegNet into turning an $11 wallet balance into $6.7 million. According “WhoSoup”, a PegNet core developer, a group of miners controlling as much as 70% of hashrate artificially inflated the price of a stablecoin pegged to the price of Japanese Yen (pJPY), turning ~1,265.79 pJPY (~$11.79) into ~6.7mm pUSD. The miners then attempted to liquidate as much as they could on exchanges.

It’s unclear how much money the attackers were able to make, considering they needed to convert pUSD into the PegNET's native PEG cryptocurrency before selling on exchanges, and PegNET’s protocol does not allow for quick conversions. Furthermore, the attacker has since burned all it’s stablecoins and reached out to PegNet claiming it was just attempting to identify potential vulnerabilities and notify core developers. The miners who launched the attack have been mining on PegNet honestly for a while.

In order to keep its stablecoin prices pegged, PegNet relies on miners to submit price data. Each block requires up to 50 data points, with the protocol discarding the 25 submissions furthest away from the total average. According to core developers, miners performed the attack by submitting 35 of the top 50 price submissions, significantly skewing the average in their favor.

Why it matters:

• Exploits are picking up in pace this year as many decentralized finance protocols get tested. Honeypots in DeFi have grown too large for would be hackers to merely point out vulnerabilities.
• It’s become clear over the past couple months that what’s protecting these protocols from severe losses is not these protocols’ robust security properties. Rather they are protected by exchanges conducting surveillance, legal systems providing recourse, and slow blockchains limiting transaction throughput.