First hack of 2022?

Wild wild west strikes again. Looks like someone found a way to remove assets from the goBTC (wrapped btc on algorand) pool on Tinyman. Around 60BTC were drained. Boy that was fast.

No official announcement is out yet, but here's a user's description of the sequence of the events:

​

From u/CryptoFarmer1020: Deposited 88.573738 ALGO from Kucoin. This was about $150 at the time of deposit. So person is likely using a dollar framework.

Opted into Algofi - Opted into goBTC-ALGO - Opted into goETH-ALGO

Swapped 31.3 ALGO for 0.00115 goBTC.

Added liquidity to goBTC-ALGO pool.

Removed liquidity from pool and somehow got additional 0.3goBTC as part of the transaction. This is where whatever exploit they did probably happened.

Swapped goBTC for ALGO. Added liquidity again. Removed liquidity and got additional 5 goBTC. Swapped again goBTC for ALGO

Third time was the big drain. Added liquidity, then removed and got 28+ goBTC extra.

Edit4: Timeline continued.
They moved on and did the same to the goETH-ALGO pool and got about 130 goETH
Started to convert both goETH and goBTC to USDC and then to ALGO. Sent both back to Kucoin, 58.6K ALGO and 248K USDC
Parked 123.5K goETH and 5.6 goBTC in Algofi. Wallet still has 21.4 goBTC and 2K Algos.

Read more in the Algorand reddit

This may be affecting other liquidity pools on tinyman so it could turn out into a much bigger shitfest.

​

Edit: goETH were also drained from the pool.