The Mozaic Exploit: How Insider Access Led to a $2M Theft

On March 15, 2024 Mozaic faced a devastating exploit. Orchestrated by an insider with malicious intent, approximately $2 million was drained from its vaults, sending shockwaves through the community and causing a significant plunge in the $MOZ token value.

First — who is Mozaic?

Mozaic is at the forefront of integrating cutting-edge artificial intelligence (AI) and blockchain technology to redefine yield farming in the Web3 ecosystem. By leveraging LayerZero technology, Mozaic offers an automated, decentralised platform designed to optimise returns for its users. Founded by a dedicated community with a vision to democratise access to complex DeFi strategies. This vision however was put at risk by one of their own!

Quick stats from D3ploy for the Mozaic exploit

Lets get into the details

In the early hours of March 15th, the Mozaic community was faced with a startling announcement: the Mozaic Vaults had been compromised with $2M stolen from the platform. With an initial air of mystery surrounding the event, details were scarce. The only information available was that a significant amount of funds was now locked on MEXC. Despite the uncertainty, Mozaic’s initial statements offered a glimmer of hope, assuring the community that steps were being taken to secure the return of the stolen assets. As the situation unfolded, Mozaic promised transparency, pledging to provide updates and a thorough follow up once the situation had been fully investigated.

Mozaic’s communication strategy during the crisis prioritised minimising potential further damage. The delay in public announcements was a strategic choice, advised by security partners, to prevent alarming the attacker and risking additional harm to Mozaic’s systems.

[embed]

Detection and Response

The exploit was initially detected by CertiK, alongside alerts from other security firms. Mozaic’s response, while swift, faced the harsh reality that the vault contracts were paused only after the funds had been syphoned off. In a concerted effort with security partners, exchanges such as MEXC and Binance were promptly contacted, leading to the freezing of over 90% of the stolen funds on MEXC.

[embed]

Who was responsible?

The Mozaic vaults were compromised by a developer who, in a profound breach of trust, illegally accessed and used the private keys of a security module. This module, a critical component of Mozaic’s security infrastructure designed as a fail-safe, was in the transitional phase of being replaced by more robust measures from HypernativeLabs. Seizing the opportunity, the rogue developer exploited this narrow window, effectively bypassing the emerging security protocols.

Unfortunately, simultaneously, an institutional investor’s decision to exit their MOZ position due to the dwindling TVL and falling MOZ price exacerbated the situation. This move triggered a cascade of sell-offs, further driving down the price of $MOZ.

[embed]

Recovery and Future Steps

Efforts to recover the stolen funds are in full swing, with a significant portion already frozen and under negotiation for return. The pathway to recovery involves intricate legal and procedural steps, especially for funds withdrawn to on-chain addresses from Binance, highlighting the complexity of addressing cyber theft in the decentralised finance (DeFi) space.

In the aftermath, Mozaic has taken decisive actions to mitigate future risks. This includes terminating the malicious actor, pursuing legal and criminal charges, and conducting a thorough internal investigation. All Mozaic employees have been temporarily restricted from accessing internal systems to allow for a comprehensive security overhaul.

[embed]

The Unified Front: Mozaic’s Community Response

In the aftermath of the Mozaic exploit, the project’s community emerged as a beacon of resilience and unity. The overwhelming support from community members highlighted the collective strength that underpins the Web3 ecosystem. Beyond individual contributions, such as the notable support from @0x7d54, the broader Mozaic community rallied together, offering both moral and strategic support. This solidarity was a powerful counterbalance to the turmoil caused by the exploit, showcasing a deep-rooted commitment to the project and to each other.

[embed]

Reflections and Lessons

This incident, marked by a betrayal from within, stresses the critical importance of internal security and the vigilance needed in managing and upgrading security protocols. Mozaic’s ordeal serves as a stark reminder of the sophisticated threats facing the Web3 space, emphasising the need for continuous improvement in security practices, and although Mozaic was quick to react to the exploit, this isn’t always the case.

Here are some tips from d3ploy, in case your assets from a project come under attack!

D3ploy’s tips for protecting your assets from a project under attack

Mozaic’s Resilience

Despite the severity of the exploit, Mozaic assures its community that the core components of the project, including the MOZ/xMOZ token, vault contracts, and AI technologies, remain secure and uncompromised. The commitment to making vault depositors whole reflects a resilient stance against adversity, underscoring Mozaic’s dedication to its users and the security of their investments.

“The MOZ/xMOZ token, vault contracts, AI — remain uncompromised and secure.”

Conclusion

The Mozaic incident underscores the importance of ironclad security in DeFi, highlighting the need for comprehensive audits and swift incident management. This event not only serves as a cautionary reminder but also as a wake up call for advanced security measures.

At D3ploy, we specialise in pre-empting such vulnerabilities through our leading-edge smart contract audits and rapid response strategies, ensuring your projects remain secure against the evolving threats of the Web3 world. Let’s turn this moment into an opportunity to fortify our defences and safeguard the future of finance together. Join us at D3ploy, where security meets innovation.

**Twitter | Website**

✅To get in touch with one of our experts to book a consultation please contact us through our contact form: https://www.d3ploy.co/#Contact-Us