Blockchain DeFi Paid Network attacked and 2,000 ETH taken due to private key leak

PAID Network, a crypto project that utilizes an Ethereum-based token, for smart contract program for DeFi, has suffered a contract exploit, resulting in the minting of nearly $160 million worth of tokens by the attacker. Network data shows that just over 2,000 ETH, worth roughly $3 million at press time,was obtained by the attacker after some of the 59.7 million minted PAID tokens were traded on the decentralized exchange service Uniswap. Roughly 2.5 million PAID tokens were sold over the course of 13 transactions, according to Etherscan data. 

Per Etherscan, the minting took place just after 6 p.m. UTC, with the transactions to Uniswap occurring between 6:07 p.m. UTC and 06:27 p.m. UTC. The price of PAID was trading at roughly $2.86 per token prior to the price plunge, giving the minted tokens a value of about $159.3 million at the time of their creation. The token's price is currently trading at about $0.32, representing a 24-hour decline of more than 88%, according to data from CoinGecko.

In a telegram note from CEO Kyle Chasse, he noted, " The PAID team has pulled liquidity from UniSwap to minimize damage, and asked all PAID Network token holders to cease all trading and have called in industry experts cipherblade, parsiq certik and others to safeguard users and specifiy next steps."  The incident started because of a private key leak. The second failure was a key management failure as the compromised key provided access to the PAID token contract, and was used to modify the token contract to allow attacker to maliciously burn and then remint PAID Tokens. The full statement can be found here.