Dego Finance + Cocos-BCX: Compromised Private Key — Multi-chain LP Drain + Token Mint

Dego Finance lost ~$10M across three chains when a compromised private key gave attackers admin access to LP tokens and the DEGO token mint function, with no multi-sig protecting any of it.

Occurred 2022-02-10 Loss $10M Status closed

Summary #

Dego Finance + Cocos-BCX suffered a NFT / DeFi Platform on 2022-02-10, resulting in a loss of approximately $10M.

What happened #

Dego Finance lost ~$10M across three chains when a compromised private key gave attackers admin access to LP tokens and the DEGO token mint function, with no multi-sig protecting any of it.

Linked factors #

RD-F-007 — related : Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
RD-F-111 — causal : Team doxx status — pseudonymous-no-track-record class [via dashboard_risk_factors/Team anonymity: Unknown — team made public statements and coordinated with Binance]