Roll hack — March 2021

In the early hours of 14 March 2021 an attacker gained control of the private keys to a hot wallet operated by Roll, a platform that issued and held 'social money' tokens on behalf of creators. The wallet held balances of dozens of those tokens.

Roll said the incident was a compromise of the hot wallet's private keys and not a bug in the Roll smart contracts or in any token contract. The attacker sold the tokens into Uniswap for ether and moved the proceeds, roughly 3,000 ETH worth about $5.7 million at the time, into Tornado Cash. Roll's own statement listed 42 affected tokens, including WHALE, FWB, KARMA and JULIEN. Prices of the largest social tokens fell more than 50 percent within hours as the attacker sold into thin liquidity; CoinDesk and Decrypt recorded WHALE, RARE and PICA among them. WHALE's treasury said only 2.17 percent of its supply was compromised because the rest sat in cold storage, and it recovered faster than others. MyCrypto flagged the coordinated selling publicly, at 08:16 UTC, before Roll confirmed it.

Roll suspended withdrawals and engaged a blockchain forensics investigator and law enforcement. A week later chief executive Bradley Miles told TechCrunch the company still did not know how the keys were taken; chief technology officer Sid Kalla said Amazon cloud logs showed no anomalous logins, and Roll's infrastructure, as distinct from its smart contracts, had never been audited before launch.

Roll established a recovery fund for affected creators, initially $500,000 and later raised to $750,000, which it used to buy affected tokens out of Uniswap pools. That is well short of the amount stolen. No arrests have been reported and the funds were not recovered.