Bifrost is a platform that allows developers to create dApps across multiple blockchains. They run the service BiFi, which is a defi platform built atop Bifrost. On July 10, they inadvertently exposed the key to their Bitcoin address-issuing server. An attacker was able to use this to self-sign their own deposit address, then make a fake deposit into the BiFi Bitcoin lending service in exchange for 1,852 ETH ($2.25 million).Bifrost wrote in their post-mortem analysis that because the attack was limited to the BTC address registration server, and the hack didn’t exploit any smart contract or protocol vulnerabilities, a security audit performed by Theori “is still valid” — leading one to wonder why anyone should trust an “audited” platform if $2.25 million in assets can be stolen without invalidating an audit.

Total loss estimated at $2,253,606.