- Crypto bridge Multichain suffered a mysterious, $125 million exploit last year.
- A court in Singapore ruled that Multichain owes the Fantom Foundation almost $2.2 million.
- The foundation believes the ruling could lead to the appointment of a liquidator and the return of stolen assets.
A court ruling in Singapore could pave the way for the eventual return of tokens that were stolen when crypto bridge Multichain suffered a mysterious exploit last July.
Judicial Commissioner Mohamed Faizal of Singapore’s High Court ruled Monday that Multichain owes the Fantom Foundation, the organisation that manages the Fantom blockchain, almost $2.2 million.
That’s the amount the foundation said it lost in the July 2023 exploit.
“Although this judgement only relates to Fantom’s own losses, the purpose of the Foundation’s litigation was to bring about the winding up of Multichain and the appointment by the Court of a third-party liquidator — which Fantom Foundation will partially fund — to help recover and distribute missing or frozen assets for all parties affected by the Multichain exploit,” the Fantom Foundation said in a statement.
Multichain didn’t attempt to defend itself during the proceedings, according to Faizal.
An inside job?
Bridges are software that lets users move crypto between otherwise incompatible blockchains. A user on one blockchain deposits crypto to the bridge, which then mints new tokens on a one-to-one basis on a different blockchain.
On July 7, 2023, after weeks of technical issues, Multichain, which was once valued at more than $1 billion, saw what it called abnormal fund movements: About $125 million in crypto had been taken from its wallets. That left assets bridged to Fantom effectively unbacked, causing their value to plummet.
About a week later, Multichian issued a shocking statement: Zhaojun He, the company’s founder, had been in the custody of Chinese police since May. His “computers, phones, hardware wallets, and mnemonic phrases were confiscated by the authorities,” the statement read.
Moreover, despite Multichain’s prior assurance that it was decentralised, control had belonged to Zhaojun alone. The company would have to shut down.
Despondent Multichain users organised on the Telegram messaging app, trading theories about where their money had gone.
To some, Multichain’s story was a cautionary tale about a failure in operational security and running a business in a crypto-hostile police state.
Others questioned the company’s account and speculated the “hack” was, in fact, an inside job.
The Fantom Foundation was among the entities that had deposited tokens in Multichain. CEO Michael Kong tapped a top law firm in China to find out what happened to the company.
In an interview last July, Kong told DL News that Multichain may have been the victim of a shakedown by local police, and he dismissed speculation that Zhaojun had run off with the money.
“There’s essentially no motive for it,” Kong said. “The Multichain team was running what many people looked at as a widely legitimate project.”
That assessment has changed.
Singapore ruling
In his ruling, Faizal noted the Fantom Foundation had taken two entities to court: Multichain Foundation Ltd, which ran the crypto bridge, and Multichain Pte Ltd.
That’s because of the “sudden incorporation” of Multichain Pte Ltd “just before the security breach on 7 July” and the foundation’s “belief that the siphoned assets could have been illegally diverted” to the entity, Faizal wrote.
But the commissioner made clear that allegation was outside the scope of his decision.
“I am not making any finding on the merits of these assertions of the involvement of [Multichain Foundation] and [Multichain Pte],” he wrote. “The merits of these assertions are not before me.”
In January, the Fantom Foundation won a default judgment against Multichain. But the foundation still had to prove how much it had lost. It also had to prove that the loss could be attributed to fraud at Multichain.
The foundation argued the loss was possible only because Zhaojun had full control of Multichain.
Faizal noted that Multichain had “admitted as much” on X, formerly Twitter.
“This contravened what the [foundation] contends to be the key term in the User Agreement, which stated that the Multichain Bridge was controlled by decentralised safe and secure [multi-party computation] nodes that are incapable of one-person control,” Faizal said.
According to Faizal, the Fantom Foundation provided a conservative estimate about the amount it lost in the exploit.
The foundation cast the judicial commissioner’s decision as a victory for those who lost money when the bridge closed last year.
“We will continue to progress the matter until a liquidator is appointed, which we anticipate will occur in the coming months, and we will pass all our knowledge and investigative material to the liquidator to facilitate and support their recovery efforts,” Fantom Foundation said in its statement.
“The liquidator will then go through an independent assessment of assets followed by claims, recovery, and distribution processes.”
Aleks Gilbert is DL News’ New York-based DeFi correspondent. You can contact him at aleks@dlnews.com.
