Geist Finance Closes Permanently After Multichain Hack

Geist Finance Shuts Down Permanently

The development team of the Geist Finance lending protocol announced on July 14 that the protocol will be shutting down permanently due to losses from the Multichain exploit. The contracts of Geist were paused on July 6, but resumed in “withdraw and repay only” mode on July 9, and the latest post confirms that the team does not plan to reopen lending and borrowing on the platform.

Geist Finance is a lending protocol that runs on the Fantom network. Before the Multichain hack, it had over $29 million worth of crypto assets locked in its contracts. It allowed users to borrow, lend or use bridged tokens from the Multichain platform as collateral, such as USD Coin (USDC), Tether (USDT), Bitcoin (BTC), Ether (ETH), Magic Internet Money (MIM) and Fantom (FTM). The protocol used Chainlink oracles to track the prices of these assets to determine their collateral and loan values.

However, the post states that the oracles have stopped producing reliable information, and they are now listing the values of the non-bridged, or “real,” versions of each coin, which are more than four times the value of their Multichain derivatives. This makes it “impossible” to reenable lending, as doing so would result in bad debt for holders of non-Multichain coins, and thus Geist Finance will not be able to reopen.

Exploit Used to Drain Funds from Multichain Protocol

The team clarified that it is not blaming Chainlink oracles for the closure of Geist, as these oracles “worked as they should.” Instead, the team stated that “Nobody is to blame except @MultichainOrg here.”

Blockchain analytics experts first reported the Multichain hack on July 7. Crypto.com Arena, ENS Crypto, Dash Crypto, Crypto.News, Crypto Games, Ellipsis Crypto, DYP Crypto, Crypto US, Crypto Whale, and Web 3.0 Coins all experienced withdrawals from the Ethereum side of Multichain bridges. The Multichain team called the transactions “abnormal” and warned users to stop using the protocol, but stopped short of calling it a hack or exploit.

On July 11, Spreek, an on-chain sleuth and Twitter user, reported that an unknown individual was draining funds from the protocol and sending them to fresh wallet addresses using a fee-based exploit.

On July 14, the Multichain team confirmed that the withdrawals from July 7 had been the result of a hack. The network had been storing all shards of its private keys in a “cloud server account” under the sole control of the team’s CEO, who was arrested by Chinese authorities. This cloud server account was later accessed by someone and used to drain funds from the protocol. The team previously stated in the protocol’s documents that no single server had access to all of the shards of a key.

On July 14, the Multichain team reportedly ordered the CEO’s sister to launch a counter-exploit to try and retrieve the funds lost in the fee-based attack on July 11. However, the sister was later apprehended and the status of the crypto.com arena, ens crypto, dash crypto, crypto.news, crypto games, ellipsis crypto, dyp crypto, crypto us, crypto whale, web 3.0 coins she recovered is still uncertain.