sd

@tonkongz, when will you publish a full incident report explaining what happened to users' funds, and provide a concrete timeline for full reimbursement? Affected users deserve answers and a clear commitment on when they will be made whole.

On Oct 19, the community brought evidence of the exploit to the team. Since then, we have seen no substantive public explanation. The only visible change we noticed was Affluent disappearing from @tonkongz's X bio.

@anatoly_makosov - TVM Ventures lists you as a Technical Advisor. Are you aware of the Affluent exploit? What is your assessment of the incident, what failed, and has the root cause been identified?

@tvm_ventures @steveyun_ton - Affluent (ex. Factorial Finance) has been described as part of TVM Ventures' portfolio. Are you aware of the reported exploit, and will TVM Ventures help push for a public explanation and a concrete reimbursement plan for affected users?

Affluent (@AffluentOrg) suffered exploits on Sept 30, Oct 12 and Oct 16, with reported losses of ~$1.1M. On Oct 19, community members shared their findings with the team. There is still no public incident report or clear plan to reimburse affected users. Full investigation:

@tonkongz, when will you publish a full incident report explaining what happened to users' funds, and provide a concrete timeline for full reimbursement? Affected users deserve answers and a clear commitment on when they will be made whole.

On Oct 19, the community brought evidence of the exploit to the team. Since then, we have seen no substantive public explanation. The only visible change we noticed was Affluent disappearing from @tonkongz's X bio.

@anatoly_makosov - as Affluent's technical advisor, can you share your assessment of the exploit? What failed, what is the current status of the affected contracts, and has the root cause been identified?

@tvm_ventures @steveyun_ton - Affluent has been described as part of TVM Ventures' portfolio. Are you aware of the reported exploit, and will TVM Ventures help push for a public explanation and a concrete reimbursement plan for affected users?

The evidence provides leads linking the on-chain investigation to Telegram accounts and an account-buying offer. Unfortunately, this does not, by itself, establish the real-world identity of the attacker.

Tracing those accounts led us to a Telegram user named "miau". In an OTC chat, this account advertised buying ChatGPT Cyber accounts via "webuygptbot".

We followed the funding trail beyond the attacking wallet. It led to a wallet holding Telegram Anonymous Numbers NFTs. We then identified Telegram accounts associated with those numbers. tonviewer.com/UQCyA3CSxhLYcm…

We identified a wallet attacking the pools and traced its transaction history, including a funding transaction from another wallet. tonviewer.com/transaction/71…

Another 125,685 GRAM was transferred via NEAR Intents. Tx: tonviewer.com/transaction/06… These three figures total 780,449 GRAM in identified outflows.

Other identified GRAM outflows included 504,724 GRAM transferred via NEAR Intents. Tx: tonviewer.com/transaction/fd…

12,824 + 1,000 USDT was bridged from TON via Symbiosis. Another 10,000 GRAM appears to have been withdrawn via Changelly. The wallet also sold GRAM on STONfi and moved funds through cross-chain services. tonviewer.com/transaction/24… tonviewer.com/transaction/46…

..then burned 10M affTONl and received 150,040 GRAM. Tx: tonviewer.com/transaction/ba… Also burned 10M affUSDTl and received 13,824 USDT. Tx: tonviewer.com/transaction/08…

..then minted 10M affTONl and 10M affUSDTl - share tokens for Affluent's GRAM and USDT lending vaults.

We noticed something was wrong with Affluent's vaults and began an on-chain investigation. On Oct 16, a newly funded wallet received 23.69 GRAM via Changelly, tx: tonviewer.com/transaction/2f…

Affluent (@AffluentOrg) is a DeFi protocol on @ton_blockchain with lending vaults where users deposit funds to earn yield. In three waves — Sep 30, Oct 12 and Oct 16 — its vaults were exploited, with reported losses of ~$1.1M. Here's how we traced the attack.