Hackers managed to steal $13 million worth of crypto tokens after exploiting the QiDAO vesting contract on Superfluid.

What Happened: In a Twitter update on Tuesday, Ethereum ETH/USD-based money streaming protocol Superfluid said it was looking into a potential exploit of the QiDAO contract that leverages Superfluid code.

“We are investigating a potential protocol layer exploit. As a precaution, please do unwrap all your SuperTokens. The attackers might be targeting wallets/contracts with large amounts,” cautioned Superfluid.

Using an ERC20 token called Super Token, Superfluid allows users to perform multiple tasks in a single transaction. By wrapping their tokens, users can initiate a money stream without needing to pay additional gas fees or transaction costs.

1/2

Quick Update. We're still assessing the situation.

- We can confirm that all funds in QiDao are safe.
- No user funds have been affected.
- We're aware there are other tokens affected.
- We'll update the community when we learn more.
- Qi bridging is temporarily paused.

— Qi Dao (@QiDaoProtocol) February 8, 2022

The contract exploit was later confirmed by QiDAO who assured users that all funds were safe.

According to crypto analytics firm Slow Mist, the attacker made a total profit of over $13 million through a number of cryptocurrencies.

3) We will continue to monitor the movement of stolen funds. #Superfluid #QiDao pic.twitter.com/RLk9Dc5cI5

— SlowMist (@SlowMist_Team) February 8, 2022

After stealing the funds, the hackers proceeded to sell large amounts of QiDAO’s native crypto token QI on the Quickswap decentralized exchange. This led to an 87% decline in the token’s value, from $1.24 to $0.16 in just 60 minutes.

Contract for $QI under superfluid was exploited (only funds from early investors locked are exploited) All vaults are safe. Funds are safu

Bought the dip/exploit, strong team + strong fundamentals, will buy the whole freaking pool if not for liquidity issue. https://t.co/NDBm3cNzxo

— Jasper (@JunHao_yo) February 8, 2022

QI’s price has since recovered to around $0.57, but is still down by 45% since the news of the exploit.

See Also: $320M In Crypto Sinks Down The Wormhole As Ethereum-Solana Bridge Hacked

Photo: Courtey of Richard Patterson on Flickr