Arbix Finance, Binance Smart Chain-based yield farming protocol, appears to have scammed users out of millions after its developers made off with their deposited funds.
Earlier this week, the blockchain security firm CertiK tweeted confirming the scam, which is known as a rug pull or exit scam. In these types of scams, project developers collect funds for an allegedly legitimate "service" and then disappear with deposited funds.
Because decentralized networks are traditionally unreliable, bodies like CertiK attempt to examine them via audits that scan a token’s smart contracts for signs of a scam, susceptibilities, privacy issues, etc. In Arbix's case, CertiK's conducted an audit on November 19th, 2021, whose findings had initially been a reason for users to trust Arbix Finance.
According to CertiK, the scam was uncovered after the token's smart contract was spotted minting 10 million ARBIX to addresses under the owner's control and then dumping them for Ethereum.
The operators of Arbix also directed $10 million in investor funds to unverified pools, a tool used to deposit and withdraw funds. An anonymous actor then drained the assets from the pools and converted them to Ethereum. Finally, Ethereum was transferred to Tornado.cash, which acts as a mixer to make it difficult to track the funds.
"Tornado Cash improves transaction privacy by breaking the on-chain link between source and destination addresses. It uses a smart contract that accepts ETH deposits that can be withdrawn by a different address," explains Tornado.cash's FAQ page. "To preserve privacy a relayer can be used to withdraw to an address with no ETH balance. Whenever ETH is withdrawn by the new address, there is no way to link the withdrawal to the deposit, ensuring complete privacy."
The funds and their movements are being tracked, but the chances of them being recovered are slim at this point.
Yield farming is a particularly enticing prospect for investors because it promises cryptocurrency investors payouts without doing anything.
The risk takers deposit cryptocurrency into yield farming platforms and then allow automated algorithms to monitor fluctuations in the values of multiple tokens and send yield returns (harvest returns) to investors according to their trading threshold settings.
The main concern with these platforms is cyber theft, as many of these platforms are either insecure or unreliable. In October 2020, a similar platform called Harvest Finance was hacked, leading to the theft of $24 million from users.