Pundi AI's Difficult Choices After the Hacker Attack

In early July, Pundi AI suffered a hacker attack, resulting in the abnormal issuance of 1 million tokens. In the face of this crisis, the team chose to first freeze and track the assets, and after ensuring the safety of the funds, publicly disclosed the situation. Ultimately, they successfully recovered and froze nearly 90% of the stolen funds, and advanced over a million dollars to complete full compensation for users.

However, Pundi AI has been notified by multiple exchanges in South Korea to delist due to "untimely information disclosure." This decision has sparked discussions about the project's transparency and crisis management.

The key timeline of the event is as follows:

• March 2: The brand has been rebranded to PUNDIAI, and the token has been swapped to PUNDI. The Hacker has been lurking but has not been detected.

• July 12: Hacker launched an attack, issuing an abnormal 1 million tokens. Transfers were frozen that day and tracking was initiated. That evening, the CEO publicly disclosed the contract vulnerability to the community.

• July 14: Disclose the results of the attack investigation and solutions to the exchange, and communicate with DAXA.

• July 28: Several South Korean exchanges announced that they will delist PundiAI on August 28.

• July 31: Official statement recovers over 80% of assets, full user compensation completed within 11 days.

Danny Lim, co-founder of Pundi AI, stated that hackers exploit vulnerabilities in token migration contracts to gain administrative privileges within the same block. This covert attack method has recently affected multiple projects, and Danny urges project teams planning token migrations or contract upgrades to remain vigilant about this risk.

In the face of attacks, Pundi AI chose to first protect user assets to avoid alarming the enemy. This strategy helped the team successfully intercept about 95% of stolen assets. However, it was also deemed "untimely disclosure" by Korean regulatory authorities due to the failure to disclose information promptly.

Danny admitted that this is a difficult choice. Should we prioritize protecting user funds or maintaining transparency? The team chose the former, but thus bore the cost. He stated that this is a painful lesson, and in the Korean market, the timeliness and transparency of information are more important than anything else.

Despite the delisting, Danny stated that the team has not given up. They plan to increase their investment in decentralized exchanges, promote new AI data products, and launch token buyback and airdrop plans to give back to the community.

For the future, Danny believes that the key to Web3 AI lies in protecting user privacy at the data level. He anticipates that when traditional AI giants realize the importance of user data privacy and proactively embrace blockchain technology, the Web3 AI sector will experience a true boom.