XX Foundation Clarifies Recent Social Engineering Incident

Last Updated on August 2nd, 2024

In a document released on July 31st 2024, the XX Foundation explains the series of events that led to 1.5m wrapped XX (WXX) tokens to be sent to an individual or group originally posing as a legitimate investor on Friday 26th July 2024..

To sum up:

No infrastructure, contracts, servers or systems were infiltrated, hacked, or compromised. It was a purely socially engineered attack, with the Foundation believing at times they were communicating with members of their own team via a (human-based) man-in-the-middle attack.
The individual/group who obtained the WXX liquidated their gains only through Uniswap over a relatively quick period, and as a result of the low liquidity, at a price of over half the market rate of the time.
The Foundation suffered a mixed loss of the WXX and ETH through losing the tokens and with the appointed market making firm buying back some of the tokens on Uniswap, where it was impossible to pause trading in the immediate aftermath.
All centralised WXX markets and the bridge front-end were immediately paused out of caution. These are now resuming operation, since the WXX has been redistributed.
The team conducted extensive due diligence on the individual who posed as the investor which proved insufficient. They have put in place measures and procedures to avoid further issues of a similar nature in the future.

On a personal note, I was extremely disappointed to learn of this happening because I know the people at the Foundation are anything but naïve to the reality of crypto. Being a Telegram admin in the XX community, and not even part of the Foundation, I receive many would-be ‘investment opportunity’ style messages every week, and cast them aside as obvious ruses, much as the Foundation does. It’s not like folks haven’t encountered these sorts of attempts in the past, so there was an amount of preparedness that had to be overcome by the fraudsters.

On this occasion, the Foundation explained in a telegram message that the scam artist had seemingly done their homework and properly worked the plot with extensive background knowledge on the project and people behind it. They willingly did live calls and KYC and built up trust over a number of weeks.

If there is some positive to take away from this:

It was a relatively inexpensive (at least at crypto scales) learning experience for the Foundation with the outcome being much more tightly controlled internal procedures and policies.
Only the Uniswap market was directly affected by the selling of the erroneously transferred WXX.
The team were quick to act to stop other WXX markets being affected.
The community have pushed for transparency and as well as the initial report, there is a document with further clarifications for individuals who asked specific questions in the aftermath, which I feel is good for continued clarity, good-will and trust.

You can read/download the released explainer below and the clarifications below that:

Investment Scam Incident Download

Q&A Clarifications Regarding Scam Incident Download