Cross-Chain Breach Drains Roughly $10M From Dego Finance and Partner Cocos-BCX

Dego Finance and its metaverse and GameFi partner Cocos-BCX together lost close to $10 million across three separate chains in an incident both teams have attributed to compromised private keys.

The absence of a multi-signature setup on either side raises an obvious question about why such a safeguard wasn't already in place.

Describing itself as the "lego of the decentralised world," the protocol responded by asking Binance to pause deposits of its native DEGO token, and separately requested that Uniswap restrict trading of DEGO on the exchange — a request that sits oddly with a brand built around permissionless DeFi building blocks.

Whether this reflects a genuine lapse or something more deliberate remains unclear.

Beyond the "compromised keys" label, little further explanation has been offered. The attacker appears to have taken essentially everything available. Slowmist published a list detailing the assets that were removed.

The same wallet, 0x118203b0f2a3ef9e749d871c8fef5e5e55ef5c91, surfaced on Ethereum, Binance Smart Chain, and Cronos.

Across both BSC and Ethereum, the attacker collected numerous LP tokens and then minted an additional 600,000 DEGO directly, a move that drove the token's price down by 16%.

Even so, DEGO's price chart shows a gradual recovery following the attack, likely helped by the project's substantial reach — around 194,000 followers on Twitter alone, alongside its presence on other platforms.

Since the breach, Cocos-BCX has shifted contract ownership to a multi-signature wallet. Dego Finance is expected to make a similar change.