Jul-06-2023 07:02:47 PM - An unknown address takes control of Multichains MPC keys which give access to multiple vaults which backs bridged funds across multiple chains.

Jul-06-2023 07:11:59 PM - This unknown address moves 910,654 UNIDX tokens from the FTM bridge vault to another unknown EOA address 0x9d5765ae1c95c21d4cc3b1d5bba71bad3b012b68.

Jul-06-2023 07:20:32 PM - UniDex team reaches out to Synapse & multichain to freeze bridges.

Jul-06-2023 07:37:47 PM - By this time, the malicious actor has moved over $130,000,000 in funds, including USDC, DAI, WBTC, LINK, other various tokens, and of course, our UNIDX token.

Jul-06-2023 12:27:41 AM - Multichain issues a statement claiming they have no idea who this address is, and it was not communicated by internal team members.

Jul-06-2023 06:57:23 AM - Multichain claims the bridge is frozen and all users should not use the bridge at this time

What does this all mean

Yesterday, July 6th, someone took control of all the locked UNIDX which backs the UNIDX minted on external chains bridged by multichain. If someone bridges 100 UNIDX from ETH → Fantom, 100 UNIDX is locked in this MPC controlled vault on ETH, and 100 UNIDX is minted on Fantom.

This means that for every 1 UNIDX on Optimism, Fantom, Metis, or any other chain that UNIDX is bridged to through multichain. There should be 1 UNIDX locked in this vault on ETH. However, an unknown address (to everyone’s current knowledge) took control of the vault and moved funds to an external address not controlled by multichain. This means that all the UNIDX on chains bridged by multichain (Optimism, Fantom, Metis, and Boba ETH) are no longer backed by anything.

Instead, this unknown address now controls 910,654 UNIDX of stolen funds which remains held on ETH alongside millions of other stolen assets such as LINK, WBTC, and various stablecoins. This UNIDX belongs to users who have bridged over to multichain bridgable networks.

The Plan

Currently, there is no clear indication of who this address is outside of rumors spreading on social media. However, we should consider multichain exploited and their security compromised and take action before this address takes action.

Here is the current call to action

• If you are providing liquidity on ETH mainnet, Optimism, Fantom, Boba, Metis, or zkSync. Please remove your LP position as you face the risk of losing your capital

• If you are holding UNIDX in any protocol on ETH mainnet, Optimism, Fantom, Boba, Metis, or zkSync. Please withdraw your funds ASAP and hold it in your wallet (EOA) on the same network.

• If you are holding UNIDX or providing liquidity on Arbitrum, no action at all is needed. Arbitrum holders are completely unaffected and don’t need to do anything at all.

• If you are holding on all other networks in your wallet (EOA). You also do not need to do anything and do NOT attempt bridging through multichain.

The current plan is to snapshot everyone’s balances once the amount in liquidity pools, smart contract wallets, and various staking platforms decreases to an amount where very minimal damage can occur. There are still many people attempting to provide liquidity in farms such as Velodrome, Arrakis, or Beefy Vaults. Understand that after the snapshot you will end up in a complete loss in your LP position. This risk is not worth the small farming rewards earned on these weekly farming protocols.

There is still around $160,000 of liquidity provided on Velodrome where 7 addresses make up more than 80% of all liquidity, around $11,000 of UNIDX held in various Gnosis Safes, and $23,000 of UNIDX held in other various smart contracts. Understand that these funds are at risk of near-total loss after the snapshot and some addresses don’t guarantee funds will be available to you.

The snapshot

Once we believe the amount of provided liquidity, smart contract held UNIDX, and Gnosis Safe wallet UNIDX decreases to safe levels. We will take a snapshot of everyone’s balance while excluding wallet 0x9d5765ae1c95c21d4cc3b1d5bba71bad3b012b68 which is the unknown Multichain exploiters wallet.

Everyone will receive a new UNIDX token on ETH equal to the balance they held on other chains bridged by multichain (or zkSync). Note that buying after this snapshot will not earn you any additional UNIDX on ETH. Only the balance at the time of the snapshot will be honored. Once again we will announce when we will be doing a snapshot when more users migrate out of smart contract held funds as these users are at risk of high market sell pressure post-snapshot.

Arbitrum users are completely unaffected and don’t need to do anything at all. With the new UNIDX token on ETH, we have cooperated with the Synapse team to allow all UNIDX on Arbitrum to withdraw to the new UNIDX on ETH 1:1. Moving forward, all bridging activity will be done through Synapse which means a new UNIDX address on ETH, OP, FTM, and Boba ETH as a Synapse xAsset.

We also want to thank the Synapse team for an extremely fast response and quick cooperation. We’ve sent over 60 messages to the multichain team and various group members and still have not received a single reply, however the Synapse team responded nearly instantly and took action.

The old UNIDX token will no longer hold any governance power or have any liquidity in the market. You’re still free to do whatever you please with these tokens but they are no longer officially recognized by the protocol.

Wrap up

Let’s go over what users need to do in quick bullet points

• If you hold funds on all chains (except arbitrum) anywhere other than your wallet. Please move them to your wallet in order to ensure you get your balance airdropped to you correctly.

• If you’re an Arbitrum holder you do not need to do anything before or after the snapshot

• Buying after the snapshot should be done at your own risk, as any balance after the snapshot will not be honored

• The time of the snapshot is still not determined but be announced when potential damage and loss are minimalized to passive unaware holders.

• There will be a new UNIDX token on all chains except Arbitrum.

• All holders will receive funds on ETH as this will be the native chain for token deployment.

• If you are attempting to farm, do understand you will experience a great loss of your LP position as once the snapshot is taken, the typical market reaction is to sell into remaining LPs completely.

Overall we are completely disappointed by the security measures and response times from the Multichain team. We’re also sorry for the extra stress holders must be going through, not only for UNIDX, but users of chains like Fantom where multichain was the main bridge for the ecosystem. We managed to minimalize any potential damage, but we have a better bridging partner moving forward and the future still remains bright.

If you have any questions, please do not hesitate to reach out and join our Discord channel linked below.