Quixotic Hack and Its Aftermath

    What's going on with Optimism?

    The following charts, show the number of transaction by the attacker and the amount of OP stolen per hour, on the day of attack. It seems that:

    • The attack happened during 4:12 and 5:07.
    • During the attack, the funds are transferred to attacker’s wallet.
    • In total more than 213K $OP was stolen.

    Introduction

    Optimism is one of the layer 2 scaling solutions. It's powered by a technology called Optimistic rollups, which bundle large amounts of transaction data into digestible batches. Optimism is much cheaper to use than Ethereum.

    Quixotic is the largest NFT marketplace on Optimism. It has an average transaction fee of just 0.0005 ETH ($0.75)


    In this Dashboard, we are going to take a look into Quixotic NFT marketplace recent exploitation, also take a look on its impact on users activity. The following items are going to be examined:

    • Daily Transaction Count
    • Amount Stolen
    • Daily Volume
    • Daily Number of Users
    • Daily Number of Whales

    Approach

    In this study, the optimism.core.fact_event_logs table is used to get all the user transaction and interaction with the marketplace, the optimism.core.ez_eth_transfers table is used to acquire the volume traded in ETH and the optimism.core.fact_token_transfers table is used to get volume traded on other tokens such as OP and WETH.

    Currently, the Optimism dataset is not fully backfilled, and only data from June 15 is available, which is sufficient for our study.

    In this study, the whales are defined as users who have transferred more than 5 ETH in Optimism network.

    Daily Transaction Count

    The following chart depicts the number of daily transaction before and after the exploitation. After the attack, they deployed a new contract, the chart below shows the daily usage of each contract. The attack happened on July 1st. It can be seen that:

    • During the day of the attack a very high transaction count is recorded, this is due to attacker’s activity.
    • Surprisingly, the number of daily transaction didn’t change much after the attack.

    Let’s take a deeper look at the day of the attack.

    The chart below shows the transactions that happened during the night of the attack.

    • There are a burst of extensive usage at 3:00-3:30, right before the attack
    • Attack happened on 4:16 and lasted for almost one hour.

    In the next section, hacker’s wallet activity is examined.

    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...

    Daily Volume

    The following charts show the volume few days before and after the attack.

    It can be seen that:

    • Before the attack the average volume was about 10k.
    • After the attack the average volume hovers right below 5K.
    • Right after the attack and deployment of the new contract, volume increased significantly, this could be due to users removing their funds or selling their NFTs and just running away.

    Daily Number of Users

    The following chart shows the number of daily unique users. It seems that the average number of users didn’t decline significantly after the attack, one could say that it has stayed almost the same.

    It seems that the attack could not tarnish users' trust.

    In the next section we will study whales activity.

    Users By Amount of ETH Transferred Distribution

    The following chart shows the users distribution by the amount of ETH they have transferred on Optimism. We are going to take the top 4% of the users and call them whales, these users have transferred at least 5 ETH since Jun 15.

    Daily Number of Whales

    Looking at the graphs below, we can conclude that even the whales stayed on the platform and did not leave it.

    Summary

    The results of the study can be summarized as follows:

    • The number of daily transaction didn’t change much after the attack.
    • Before the attack the average volume was about 10k but after the attack the average volume hovers right below 5K. So It has dropped by almost 50%
    • In total more than 213K $OP was stolen.
    • It seems that the attack could not tarnish users' trust. The number of users using the platform didn’t diminish much.
    • Whales also continue to use the platform.