Cyber Incident Victim: Sportfondsen Nederland
Date:
Oct 2023
Location:
United States of America
Summary
A cyber attack targeting Unibot's Telegram-based trading platform exploited a vulnerability in a newly implemented contract, resulting in approximately $560,000 in losses primarily from memecoins held by users. The breach triggered a rapid 43% decline in the platform's token value before partial recovery, while blockchain analysts identified ongoing fraudulent activity through a similar malicious address. The firm suspended the compromised routing system, acknowledged the approval flaw, and committed to reimbursing affected users. Security recommendations included revoking contract permissions and migrating assets to more secure wallets.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 29, 2023, Unibot, a Telegram-based trading bot facilitating transactions on the Uniswap decentralized exchange, experienced a security breach involving an exploit in a newly implemented contract. The breach remained undetected until October 31, when blockchain analytics firm Scopescan identified unauthorized asset transfers and alerted users. Unibot confirmed the incident stemmed from a vulnerability in token approval mechanisms within its recently launched routing system, which allowed an attacker to siphon approximately $560,000 worth of user-held memecoins. The compromised assets included UNIBOT (the platform’s native token), Joe (JOE), and BeerusCat (BCAT), based on transaction analyses of the preceding week. Upon discovering the exploit, Unibot suspended the affected router to contain further losses and initiated an internal investigation alongside external blockchain forensic experts.
The breach triggered immediate financial repercussions, with the UNIBOT token price plunging 43% within one hour—falling from $57.6 to $32.9—before partially recovering. Scopescan disclosed that the attacker began converting stolen memecoins into Ethereum (ETH) and established a secondary address mimicking the exploit contract’s characteristics to target additional victims. In response, Unibot publicly committed to reimbursing all users impacted by the contract vulnerability and urged them to revoke approvals linked to the compromised contract and migrate assets to more secure wallets. The incident underscored operational risks associated with automated trading tools, though no evidence suggested broader infrastructure compromise beyond the flawed routing contract. Investigations into the attack’s origin and the perpetrator’s identity remained ongoing at the time of reporting.