According to Blockworks, Indexed Finance's crypto treasury was nearly drained in a governance token attack, but a last-minute intervention saved the remaining funds. Indexed Finance, launched in 2020 as an index fund for crypto, has been mostly inactive since a 2021 flash loan attack that drained $15.8 million from its DAO. However, the protocol remains operational, and its NDX governance token has slid to a fraction of a cent.
An exploiter recently made a nameless proposal with a two-day voting window containing code to drain Indexed's depleted treasury, which still contained around $92,000. The exploiter reached a quorum of votes in favor using the required 400,000 NDX. Former Indexed contributor Laurence Day learned of the exploit and made a plea to his followers on social media platform X. As a result, 'Against' votes flowed in, and the proposal was defeated by a margin of about $90 in NDX.
Day alleges that the person who tipped him off to the attack had first blackmailed the exploiter, asking for 40% of the funds. On-chain sleuth ZachXBT linked the wallet address of the attempted exploit to a second attack on an inactive crypto project earlier this month. Attacks on the treasuries of decrepit DAOs are becoming more common as failed projects accumulate, but immutable code keeps funds sitting on-chain. A Solana-based DAO was exploited for $230,000 last month when a malicious proposal went unnoticed. Jeremiah Smith, CEO of DeFi security service OpenCover, warns that the 'space trash' problem of on-chain applications has only just begun.
