Investors left stunned as HectorDAO remains silent following $2.7M hack

Investors in the Hector decentralized autonomous organization (HectorDAO) on the Fantom network are demanding control of the remaining funds following a hack on January 16 that resulted in $2.7 million in losses. The HectorDAO team allegedly stopped communicating with the community on January 19, and all project social channels were muted in September 2023. The team also deleted the Google Group email address that was previously used for contact. The hack occurred just as the protocol was planning to dissolve itself and return assets to investors, despite prior security warnings that were ignored. Blockchain security firm CertiK had informed the HectorDAO team of the risks associated with the “addEligibleWallet” function, but the team chose not to implement the recommended changes. CertiK provided an official audit report stating that any account with moderator privileges could call the function. However, HectorDAO claims that it engaged with CertiK for a smart contract security analysis and that all assets were secured prior to the launch of the production claim process. Blockchain analysis suggests that the attacker had access to the team’s deployer account, indicating that the exploit may have been an inside job or the result of a compromised private key. The HectorDAO hack took place after a series of difficulties, including a significant decline in HEC token price and losses resulting from the Multichain bridge hack. Despite a vote to liquidate the DAO and return funds to users, most of the $16 million held by the treasury at the time of the vote had not been distributed to investors. On January 15, the team attempted to distribute the funds, but a malicious account transferred $2.7 million worth of assets to itself. The team shut down the redemption platform and moved the remaining assets back to the treasury contract. The HectorDAO team announced the hack on January 18 and claimed to be actively investigating. However, some tokenholders blamed the development team for the hack and expressed concerns about the team’s ability to secure the funds. A post-mortem report on the attack revealed the timeline of events leading up to the hack. The HectorDAO website has not provided any updates since January 18, and investors are considering legal action. The investigation into the hack is ongoing.