Gem Pad Token Launchpad Faces $2M Exploit Across Multiple Chains

Gate’s token launchpad service has encountered a security breach, resulting in suspicious transactions across multiple chains and tokens. The platform’s team swiftly responded to mitigate the hack, revealing that several security measures had been compromised.

The team issued an urgent announcement, stating:

“An incident occurred last night where an individual managed to bypass our security protocols. We immediately reached out to our partners and industry experts to investigate and address the situation. The issue has now been…”

Blockchain analysts identified the root cause of the attack as a reentrancy vulnerability in one of the functions responsible for creating token locks. This malicious token transfer enabled the attacker to reclaim liquidity from various projects.

The exploit impacted tokens on three major networks: Ethereum, Base, and BNB Smart Chain. The GempadLock smart contract was identified as the vulnerable entry point, lacking adequate reentrancy protection.

Notably, this security breach occurred despite a recent audit by Cyberscope, which had awarded the platform a high security score. The flaw was ultimately traced to a single function within one smart contract.

Following news of the exploit, the native token of the launchpad platform experienced a gradual decline, settling around $0.11. This recent event compounds the token’s downward trend observed in the latter half of 2024.

Projects Face Consequences of Token Theft

The attacker managed to drain resources from the platform’s security locks, subsequently exchanging them for ETH and BNB before consolidating the proceeds. According to the launchpad team, only a limited number of projects were affected, and the platform has since been secured and restored to operation. However, the Locker service remains temporarily unavailable pending further notice.

Token locks on the platform are smart contracts designed to hold tokens transparently, safeguarding against potential rug pulls. While launchpads continue to serve as a distribution mechanism for new tokens, alongside meme token markets, overall launchpad volumes have decreased. Nevertheless, this particular platform has maintained a diverse portfolio of projects.

Although the core platform infrastructure remains intact, the smart contract’s logic emerged as the central point of vulnerability. Unfortunately, the affected projects and their respective communities bore the brunt of the losses.

Five Projects Impacted by Liquidity Drain

Munch Protocol was among the projects targeted in the token lock attack. The protocol, however, assured that its funds remain secure and unaffected, with potential recovery efforts supported by the launchpad team. As Munch Protocol tokens are not yet traded, they have not experienced secondary effects from the hack. The protocol has not disclosed specific details on how it safeguarded its funds or whether it incurred any direct losses.

The Nutcoin Ecosystem suffered a more severe blow, with all of its liquidity on Ethereum drained. In a concerning development, four transactions of 100 ETH each were directed to Tornado Cash, rendering them essentially unrecoverable.

Anon, another affected project, saw $3.6M in value exposed. While the Anon community on Base remains unaffected and personal wallets secure, the full extent of token losses may exceed the $2.2M currently accounted for.

FOMO Network reported that its liquidity pool on the launchpad was also compromised. Consequently, the native FOMO token plummeted from $0.004 to $0.00098. The hack also impacted the newly launched DUB token, associated with an Alien Base DEX partner, a trading application on the Base chain.

BPAY tokens’ liquidity was similarly affected by the exploit. The attacker transferred BPAY tokens directly to Uniswap V2, later converting the proceeds to WETH. In the immediate aftermath, BPAY experienced a 75% decline, dropping from $0.004 to $0.001.

While the monetary value of stolen funds in this attack was relatively modest, the secondary effects have led to a more substantial erosion of market liquidity. This incident may further undermine the integrity of the affected tokens and projects.

The timing of the attack coincided with the platform’s expansion efforts on Base and increased promotional activities to attract investors to its launchpad projects. Several new launches were anticipated in the coming days, though no explanation has been provided regarding revised methods for securing liquidity.