Cregis Research Observation: Multichain Event Investigation
1. Introduction
Multichain, originally named Anyswap, is a fully decentralized cross-chain exchange protocol based on Fusion DCRM, featuring an automatic pricing and liquidity system. Multichain is a decentralized application running on Fusion, Binance Smart Chain, Ethereum, and Fantom.
Anyswap was established in Singapore in 2020. Since Anyswap was upgraded to Multichain and received funding led by Binance Labs in 2021, Multichain has continuously encountered multiple hacker attacks and technical vulnerabilities, leading to a large number of transactions being stuck, price drops, and large-scale investor sell-offs. Currently, the CEO is missing and services are suspended, exposing the enormous risks and challenges in the Web3 world.
2. Event Retrospection
On December 16, 2021, Anyswap was upgraded to Multichain. A few days later, on December 21, a round of financing of 60 million USD led by Binance Labs was finalized, with participation from prominent institutions such as Sequoia China and IDG Capital.
On January 10, 2022, Dedaub disclosed a vulnerability to Multichain that could potentially lead to a risk of 1 billion USD. Subsequently, this vulnerability resulted in a loss of 1.34 million USD on January 18. On January 19, a white-hat hacker exploited this vulnerability and stole 200,000 USD. Although 80% of the loss was returned, three hackers exploited the vulnerability on January 20, yielding a profit of 3 million USD.
By May 2023, Multichain faced new challenges. On May 21, numerous users’ transactions got stuck, and two days later, the price of Multichain’s MULTI token dropped nearly 30%. Some large-scale investors and institutions began to sell off MULTI tokens, including the FanTom Foundation, HashKey Group, and Justin Sun. On May 25, Binance suspended deposits for 10 bridge tokens. On the same day, Andre Cronje, a director of the Fantom Foundation, explained their reason for selling off MULTI, pointing out that Multichain had experienced a five-day transaction stagnation and they had no choice but to do so.
On May 31, the Multichain team announced that they were unable to contact their CEO.
On July 7, 2023, assets from the Multichain MPC address were transferred to an unknown address. The Multichain team stated that they were investigating the matter. On the same day, Multichain announced the suspension of services, with all transactions being stuck in the source chain, and no timetable for recovery. This series of events revealed the risks and uncertainties in the Web3 world.
3. Viewpoints
- [Security issues:]{#b172}
Security issues in the crypto industry are worth deep consideration. The security issues in the DeFi and smart contract fields are not only Multichain’s problem but challenges the entire industry must face. We need to further develop and upgrade security technology, establish stricter auditing and testing processes, and even consider setting up specialized security organizations to continuously monitor and prevent possible security issues. Meanwhile, educating developers and users about crucial blockchain security knowledge is also critical.
2. Intense market environment:
In such an intense market environment, any minor misstep may lead to a project being eliminated by the market. Early project teams in the industry must always remain vigilant, continuously optimize products, improve service quality, and be prepared for crisis management and public relations.
3. Investor education:
Investors need to have some understanding of the professional knowledge in the blockchain and cryptocurrency fields before investing, and manage their risks properly. This requires public education to enhance the public’s understanding of blockchain and cryptocurrencies.
4. Transparency and trust issues:
The incidents of the Multichain CEO going missing and service suspensions once again highlight the importance of transparency and trust in the blockchain field. As a decentralized system, the actions of the team and individuals behind it still significantly impact the entire project.
Multichain event traceability：
December 16, 2021: Anyswap decided to rebrand as Multichain. [source](https://www.prnewswire.com/news-releases/anyswap-to-officially-rebrand-as-multichain-301446381.html))
December 21, 2021: Binance Labs led the most recent round of funding for Multichain, totaling $60 million. Other co-investors in this round included Sequoia China, IDG Capital, Three Arrows Capital, DeFiance Capital, Circle Ventures, Tron Foundation, Hypersphere Ventures, Primitive Ventures, Magic Ventures, and HashKey. [source](https://www.binance.com/en/blog/ecosystem/binance-labs-leads-$60m-financing-round-for-multichain-421499824684903199))
January 10, 2022: Blockchain security company Dedaub disclosed a vulnerability to Multichain, stating that it could potentially put $1 billion at risk. [source](https://media.dedaub.com/phantom-functions-and-the-billion-dollar-no-op-c56f062ae49f))
January 18, 2022: A vulnerability in Multichain resulted in a loss of $1.34 million. [source](https://twitter.com/MultichainOrg/status/1483375758382825477))
January 19, 2022: A white-hat hacker stole $200,000 through a Multichain vulnerability but later returned 80% of it. [source](https://www.theblock.co/post/130818/hacker-steals-200000-through-multichain-bug-offers-to-return-80-to-victim?utm_source=rss&utm_medium=rss))
January 20, 2022: The Multichain vulnerability was exploited by hackers, with three hackers making a profit of $3 million. [source](https://twitter.com/MultichainOrg/status/1484083811101126656))
May 21, 2023: Users complained about transactions being stuck. Multichain claimed that the delay was due to upgrades to the cross-chain router nodes. [source](https://multichain.zendesk.com/hc/en-us/articles/7036431417103-Multichain-23-May-Operation-Update))
May 23, 2023: The price of Multichain (MULTI) tokens dropped by nearly 30%, from $7 to $5.63. [source](https://www.theblock.co/post/231974/multichain-token-price-drops-20-as-bridge-upgrade-causes-delayed-transactions?utm_source=rss&utm_medium=rss))
May 24, 2023: Analysts from Lookonchain discovered several entities selling Multichain tokens on centralized and decentralized exchanges. Simultaneously, FanTom Foundation removed $2.4 million worth of MULTI from SushiSwap, HashKey Group transferred $250,000 to the cryptocurrency exchange Gate.io, and Sun Yuchen withdrew 470,000 USDD from Multichain. [1](https://twitter.com/lookonchain/status/1661351267795636224)) [2](https://twitter.com/lookonchain/status/1661403605088477184)) [3](https://twitter.com/lookonchain/status/1661356745367908358?t=8JkgxB5DrHWvU7CqsiBKRQ&s=19))
May 25, 2023: Following a five-day transaction delay on Multichain, Andre Cronje, director of the Fantom Foundation, explained their reasons for withdrawing funds from the SushiSwap liquidity pool. Also, Binance temporarily suspended deposits of 10 bridged tokens due to uncertainties surrounding the Multichain protocol. [1](https://www.theblock.co/post/232188/andre-cronje-fantom-foundation-multichain-situation?utm_source=rss&utm_medium=rss)) [2](https://cointelegraph.com/news/binance-suspends-deposits-for-bridged-tokens-seeks-clarity-from-multichain-team))
May 31, 2023: The Multichain team claimed they could not contact their CEO due to ongoing technical issues. [source](https://twitter.com/MultichainOrg/status/1663941611380965376?t=agzfDEy6MWrrId1YoBpWfg&s=19))
July 5, 2023: Binance officially announced that it will stop supporting the deposit and withdrawal of Multichain bridged tokens starting from July 7, 2023, 00:00. Due to the recent situation of the Multichain (MULTI) protocol, the deposit of multiple Multichain bridged tokens had already been suspended since May 24, 2023. [source](https://www.binance.com/en/support/announcement/updates-on-the-suspension-of-deposits-withdrawals-for-multichain-bridged-tokens-3c7d279dd37043bd8290ac718b5c08a4))
July 7, 2023, 07:27 am: The Multichain team tweeted that the assets of the Multichain MPC address were transferred to an unknown address, and they were not sure what had happened and were investigating. [source](https://twitter.com/MultichainOrg/status/1677096839731097600))
July 7, 2023, 12:57 pm: The Multichain team tweeted that the service was halted, and all transactions would be stuck at the source chain. The recovery time is undecided. [source](https://twitter.com/MultichainOrg/status/1677180114227056641))