The Superfluid vesting contract on Polygon’s native stablecoin protocol, Qi Dao, was exploited, resulting in a 65% reduction in the price of the governance token Qi Dao (QI) dropped from $1.24 to $0.18.
On Tuesday, Qi Dao acknowledged the Superfluid vesting contract exploits on Twitter but assured users that their assets were safe and that none of Qi Dao’s funds was harmed.
Superfluid also acknowledged the Qi Dao exploit and stated that it was researching the problem and would provide updates as needed. The protocol allows users to move assets on-chain in a continuous flow from one wallet to another in real-time.
While customers’ funds were not affected, the attackers made off with $20 million in tokens, including 24 Wrapped Ether (wETH), 562,000 USD Coin (USDC), 44,000 Stake DAO (SDT), 1.5 million Museum of Crypto Art (MOCA), 23,000 Stacker Ventures (STACK), and over 40,000 sdam3CRV. According to early reports, the stolen monies belonged to some of the project’s early backers and contained team-vested tokens.
SlowMist, a crypto-analytics firm, produced a fund tracker that shows the balance of each coin taken. It was believed that the hackers stole around $13 million worth of cryptocurrency after studying the wallet transaction data.
The attackers began dumping stolen Qi Dao on the QuickSwap decentralized exchange with heavy slippage, causing the governance token’s price to plummet by 65 percent.
After plunging below $0.18, the Polygon community took advantage of the opportunity to buy the dip, helping the governance token rise to $0.6. It’s worth noting that the hack was carried out via a Superfluid vulnerability, rather than Qi Dao.
Following the exploit, Qi Dao momentarily suspended its bridge, with the goal of quickly resolving the problem. The exploit was discovered within 24 hours after Polygons raised $450 million in funding; however, the community reacted positively to the native stablecoin protocol, emphasizing that the vulnerability was caused by a third-party weakness rather than a problem with the protocol itself.
