Telegram bot Maestro refunds 610 ETH to users affected by hack

The largest crypto-focused Telegram Bot project, Maestro, fell victim to a 280 ETH hack and had to return a total of 610 ETH to its clients.

According to Twitter, Maestro’s Router 2 on the Ethereum Mainnet was compromised, resulting in the unauthorized siphoning of various tokens.

The team reported identifying and neutralizing the exploit within 30 minutes, utilizing the router’s upgradeable proxy feature. This feature not only facilitates the addition of new functionalities but also serves as a protective mechanism against potential exploits. The team assures users that the router is now completely secure, and there is no need to revoke approvals or cease interactions with the router. They also emphasize that wallet credentials remain safe and are not at risk.

The attacker managed to extract 280 ETH through token sales before being permanently shut down. In the aftermath, Maestro initiated a refund strategy. Users who lost tokens during the exploit received total compensation, with some even receiving more than their initial holdings.

For the majority of the exploited tokens, the team opted to purchase and refund them directly. For two specific tokens with insufficient liquidity, affected users were compensated with an enhanced ETH equivalent. The entire refund process, costing a total of 610 ETH, was completed within 10 hours of the exploit.

Maestro’s team expressed their apologies for the incident and reiterated their commitment to user safety and satisfaction. The team confirmed that trading can now resume without any disruptions. Nonetheless, tokens associated with SushiSwap, ShibaSwap, and ETH PancakeSwap pools will remain temporarily unavailable as a precautionary measure.

Telegram bot Maestro hack: details

Maestro fell victim to a security breach resulting in the theft of more than 280 ETH, valued at approximately $500,000. 

Blockchain reporter Colin Wu revealed the breach on Twitter. The vulnerability, an external call flaw in the Maestro Router 2 contract, was swiftly exploited by cyber attackers.

According to Wu, the exploit allowed the perpetrators to make off with a considerable sum in ETH. While the Telegram bot project has since resolved the issue, there were some temporary disruptions in its associated platforms.

PeckShield also shed light on the extent of the hack. Notably, the hacker purloined around 37 million JOE coins, despite the pool having only 26 million JOE available. This move had a cascading effect, leading to a price impact of -30 on swaps involving JOE.

The recent Maestro contract exploit is the latest in a long line of crypto-focused hacks that have plagued the crypto scene throughout this year. In a shocking case this month, a hacker manipulated the BH Token on BNB Chain to create an arbitrage opportunity, making off with $1.2 million.