ParaSwap Refunds Users as Augustus V6 Hacker Faces Ultimatum

ParaSwap embarks on a funds recovery process following a vulnerability in its Augustus V6 contract.

Money being handed down from the sky.
Created by Gabor Kovacs from DailyCoin
  • ParaSwap has refunded some users affected by a vulnerability in one of its contracts.
  • The platform later contacted the hacker and issued an ultimatum.
  • It remains unclear how much was stolen following the vulnerability.

Decentralized finance (DeFi) aggregator ParaSwap has commenced returning crypto assets to users recently affected by a critical vulnerability in one of the platform’s newly deployed contracts.

On March 20, ParaSwap identified a vulnerability in its Augustus V6 contract, allowing hackers to drain funds from over 386 exposed wallets when approved. The platform paused the contract and conducted a white hack to secure funds for users who were at risk.

ParaSwap Disburses User Funds, Issues Ultimatum to Hacker

According to a recent update on X, ParaSwap has returned crypto assets to wallets that revoked their permissions to the Augustus v6 contract and were successfully recovered by white hat hackers.

A few hours later, the ParaSwap team shared another post detailing its steps to identify the hacker and launch the investigation into the stolen funds.


In addition to submitting a “comprehensive report to the appropriate authorities” and collaborating with Chainalysis and TRM Labs to trace the movement of the funds, ParaSwap initiated contact with the hacker via on-chain messaging, urging them to return the stolen user funds.

The platform advised the hacker to transfer the funds directly to a specific address by March 27 or face serious consequences.


“If we do not hear back from you by Wednesday, March 27, 2024, 23:00 UTC we will assume you appropriated the funds with unlawful intent and we will pursue all criminal, legal, and administrative avenues available for the purpose of recovering the misappropriated funds,” ParaSwap wrote.

Although there is a likelihood that ParaSwap might recover the funds if the hacker heeds the call, it remains unclear how much was exactly stolen.

How Much Was Stolen?

While ParaSwap initially said only four addresses were compromised on March 20 and lost a total of $24,000, blockchain security firm Cyvers reported that the Augustus V6 contract vulnerability resulted in a total loss of $123,500.

Meanwhile, of the 386 addresses exposed to the vulnerability, only 173 have received their funds, and 213 addresses have yet to revoke allowances to the flawed contract. Per ParaSwap, these addresses are still vulnerable and might be exploited.

Read how AirDAO was recently exploited:

AirDAO Loses 35.2M AMB and 125 ETH to a Uniswap Pool Exploit

Stay updated on how FTX and BlockFi claimants were scammed for millions:

FTX, BlockFi Claimants Scammed For Millions Via Fake Emails

This article is for information purposes only and should not be considered trading or investment advice. Nothing herein shall be construed as financial, legal, or tax advice. Trading forex, cryptocurrencies, and CFDs pose a considerable risk of loss.

Brian Danga

Brian Danga, a Kenyan crypto reporter, is dedicated to delivering breaking news and updates from the cryptocurrency world. With a background as a Web3 writer and project manager, he recognizes the importance of unbiased reporting. Holding an LLB degree from the University of Nairobi, Brian's analytical skills contribute to his accurate news reporting. His personal interests include cooking, watching documentaries, reading, and engaging in intellectual discussions.