Nexus Mutual founder's personal wallet address gets attacked, funds worth more than $8 million get drained

Hugh Karp, the founder of DeFi insurance protocol Nexus Mutual, has just experienced an attack that resulted in a loss of more than $8 million.

Nexus Mutual announced the news via a Twitter post on Monday, saying that Karp's personal wallet address was attacked and drained by a member of the protocol.

The address contained 370,000 NXM (Nexus Mutual) tokens, currently worth about $8.25 million. 

Karp told The Block that the attacker tricked him into approving one transaction, somehow gained access to his computer, and altered his MetaMask extension.

"Then when I was performing an unrelated transaction, MetaMask popped up with a spoof transaction, and I subsequently approved it, thinking it was the transaction I was intending to conduct. Instead, it was transferring NXM to their wallet," said Karp.

Nexus Mutual is unaffected and nobody else is impacted, he said. "My private keys are still secure. The attacker didn't get access to them. They tricked me into signing a spoof transaction," said Karp. 

He characterized the attack as a "very nice trick" and "definitely next level stuff." 

Nexus Mutual said the attacker completed their know-your-customer (KYC) processes 11 days ago and then switched membership to a new address on December 3. The protocol developer added that an investigation is ongoing to identify the attacker and how they operated.

Karp asked the attacker to return funds to drop all investigations and get $300,000 in the bounty. 

Some of the stolen funds are already on the move, said Nexus Mutual, adding that some are already being exchanged using decentralized exchange aggregator 1inch.Exchange.

This is a developing story and will be updated as more details are known.