MM Finance hack — May 2022

On 4 May 2022 attackers took more than $2 million from users of MM.Finance, at the time the largest decentralised exchange on the Cronos chain. The theft did not involve a smart contract flaw. The site's front end was altered so that the router address user transactions were directed to was replaced with one the attacker controlled; anyone who traded or removed liquidity through the website while the injected address was live sent their tokens to the attacker rather than to the exchange.

The team's own statement was that an attacker used a DNS vulnerability to modify the router contract address in its hosted files. Once the substitution was identified the front end was taken down. Every published account of the mechanism traces back to that self-report; no independent technical post-mortem was produced.

The stolen assets, reported as CRO, were bridged from Cronos to Ethereum via Multichain and passed through Tornado Cash, with part of the flow later traced to OKX. Ethereum was the laundering route, not a venue of the theft. MM.Finance publicly offered the attacker a deal on Twitter, to return 90% of the funds within 48 hours with no questions asked, and said it would involve the FBI if the deadline passed. There is no published confirmation that any funds were returned.

The team said more than $2,000,000 would be compensated and reimbursed, and described funding a compensation pool from its share of trading fees over a 45-day period. Completion of that programme has not been independently confirmed, which is why the outcome is recorded as unresolved rather than as users reimbursed.

The loss has been consistently described as 'more than $2 million' rather than as a precise total. No reconciled accounting of individual victim losses was published, so the figure recorded here is a floor.