Defi Protocol Founder Tricked, Hacked for $8 Million in Personal Funds

Nexus Mutual founder and chief executive officer Hugh Karp’s personal wallet address has been hacked for more than $8 million.

The attacker, a member of the Nexus defi protocol, tricked Karp into signing a transaction that transferred funds to the hacker’s own address. The attacker gained remote access to Karp’s computer and modified his Metamask extension.

Some 370,000 Nexus Mutual (NXM) tokens, worth about $8.25 million on Monday, were stolen from Karp’s personal wallet address, as a result.

In a tweet, Nexus Mutual said the hack, which happened the morning of Dec. 14, was a “targeted personal attack on Hugh”. Karp described the attack as a “very nice trick,” and “definitely next level stuff.” He pleaded:

You’ll have trouble cashing out that much NXM. If you return the NXM in full, we will drop all investigations and I will grant you a $300k bounty.

Nexus Mutual is unaffected by the hack nor are any members victims for this scam. The protocol said the hacker completed their know-your-customer (KYC) processes 11 days ago and then switched membership to a new address on December 3.

Nexus added that an investigation is ongoing to identify the attacker and how they operated. The team at Nexus said the stolen funds are being held at this address, and the attacker has already started exchanging some via 1Inch Exchange.

Meanwhile, the attacker reportedly cashed out up $2.7 million of his loot on Tuesday, according to blockchain analytics firm Scorechain. The hacker made several swaps of the stolen NXM on Uniswap via 1Inch Exchange, giving them roughly 137 BTC valued at $2.7 million at current market prices..