The Incident of Pundi AI Being Hacked and Delisted by a Korean Exchange

On July 12, Pundi AI experienced a hacker attack that resulted in the abnormal issuance of 1 million tokens. In response to this crisis, the team took measures to freeze, track, and recover assets, and publicly disclosed the incident after ensuring the safety of the funds. Ultimately, nearly 90% of the stolen funds were successfully recovered and frozen, and over one million dollars were advanced to complete full compensation for users.

However, due to the "untimely disclosure of information", Pundi AI was notified by the Digital Asset Exchange Association of Korea (DAXA) to be delisted from Korean exchanges. This decision has sparked discussions about project management and information transparency.

Event Review

• March 2: Function X announced a rebranding to PUNDIAI and a token swap.
• July 12: Hacker launched an attack, resulting in the abnormal issuance of 1 million tokens; the project team froze transfers and initiated tracking; that night, the CEO publicly disclosed the contract vulnerability to the community.
• July 14: Disclose the results of the investigation into the attack incident and the solutions to the exchange, and communicate with DAXA.
• July 28: Some Korean exchanges announced the delisting of PundiAI on August 28.
• July 31: Official statement retrieves over 80% of assets, full compensation for users completed within 11 days.

Hacker Attack Details

Hacker exploited a vulnerability in the token migration contract. When the new contract was deployed in February, the hacker submitted a transaction with a higher Gas fee, gaining administrator privileges of the contract ahead of others. This attack method is very precise and requires accurate calculation of the timing of the transaction and the block.

The vulnerability is stealthy and was only discovered when the attack occurred in July. Recently, multiple projects on the Base chain and Ethereum have encountered similar attacks, demonstrating that this "front-running attack" poses a potential threat to projects planning token migrations or contract upgrades.

Measures and Results

The Pundi AI team has taken the following measures:

1. Suspend the deposit and withdrawal functions of PUNDIAI.
2. Track and freeze stolen assets.
3. About 95% of stolen assets were intercepted on the Ethereum and F(x)Core mainnet.
4. Provide full compensation to affected users.

In the end, among the newly issued tokens worth approximately 6 million USD, the team successfully recovered 87% of the assets and incurred a loss of nearly 2 million USD on their own.

Impact on the South Korean Market

Pundi AI has been operating in the South Korean market since 2019, accumulating a large user base. This delisting has a huge impact on the project's liquidity, with about 80% of the trading volume and 70% of the tradable tokens being on centralized exchanges in South Korea.

Despite the delisting, the price of Pundi AI remains relatively stable, showing the trust of the community users. The team is actively communicating with DAXA and major exchanges, hoping to return to the Korean market.

Future Plans

1. Increase investment in decentralized exchanges to provide sufficient liquidity.
2. Promote the new AI data product Data Pump.
3. Implement token buyback and airdrop programs to reward supporters.

AI Data Product Introduction

Data Pump is an "AI dataset Launchpad" designed to tokenize data. Users can package various content data into NFTs, then stake them on the platform to generate tokens and trade them on DEX.

Compared to other AI data projects, Pundi AI focuses on high-quality data in specialized segments such as medical imaging and autonomous driving. In addition, they have developed AI AMM (Automated Market Maker) to achieve the assetization and monetization of data.

Outlook on Web3 AI Development

The main bottleneck in the current development of Web3 AI lies in the lack of applications that truly change lives. Decentralized computing power is currently difficult to support the operation of large language models. The main value of blockchain technology in the AI field is to protect user data sovereignty and privacy.

In the future, the real boom in the Web3 AI sector may need to wait for traditional AI giants to actively embrace blockchain technology to provide users with data protection features. This trend is likely to be led by traditional giants rather than driven by Web3-native projects.