The Pundi AI Token Theft Incident: A Dilemma Caused by Security Measures

On July 12, Pundi AI suffered a hacking attack, resulting in the abnormal issuance of 1 million tokens. In the face of this crisis, the team chose to first freeze, track, and recover the assets, and after ensuring the safety of funds, publicly disclosed the situation. Ultimately, nearly 90% of the stolen funds were successfully recovered and frozen, and over 1 million dollars were advanced to complete full user compensation. However, Pundi AI was notified by a major exchange in South Korea to be delisted due to "untimely information disclosure."

Event Key Timeline:

• March 2: The brand was rebranded to PUNDIAI, and the token was replaced with PUNDI. At this time, the hacker had already infiltrated but had not been detected.
• July 12: Hackers launched an attack, resulting in an abnormal issuance of 1 million Tokens; transfers were frozen that day and tracing was initiated; in the evening, the CEO publicly disclosed the contract vulnerability to the community.
• July 14: Disclose the investigation results and solutions of the attack incident to the exchange, communicate with regulatory authorities.
• July 28: South Korea's major exchanges announced the delisting of PundiAI on August 28.
• July 31: Official statement retrieves over 80% of assets, full user compensation completed within 11 days.

Danny Lim, co-founder of Pundi AI, stated that hackers exploited a vulnerability in the token migration contract to gain admin privileges in the same block. To maximize asset recovery, the team decided to quietly track and freeze the assets to avoid alerting the hackers. This strategy proved effective, successfully intercepting about 95% of the stolen assets.

However, this approach has also brought about the issue of insufficient transparency. Danny admitted that a balance was not well struck between "quietly recovering assets" and "public disclosure at the first moment," reminding all projects that are online or planning to go online in South Korea: in the South Korean market, the timeliness and transparency of information are more important than anything else.

Regarding the delisting, Danny expressed that his biggest concern is the impact on their reputation. Many people may not investigate the reasons and will simply label Pundi AI negatively. This leads to a misunderstanding of their years of effort and credibility.

Despite the difficulties, Danny emphasized three core plans:

1. Increase investment in decentralized exchanges to provide users with sufficient liquidity.
2. Promote the brand new AI data product Data Pump vigorously
3. Release the Token buyback and airdrop plan to reward supporting users.

Data Pump is an "AI dataset Launchpad" designed to tokenize data. Users can package content data into NFTs, then mortgage them to generate tokens and trade on DEX. Danny believes this will be a key focus for the future development of Pundi AI.

Regarding the development of the Web3 AI field, Danny believes that the current bottleneck lies in the lack of truly useful applications. He points out that the real value of blockchain in the AI field is at the data layer, protecting user data sovereignty and privacy. However, ordinary users have not yet realized the importance of data privacy.

Danny predicts that the Web3 AI sector will usher in a real boom, which may require traditional AI giants to actively embrace blockchain technology to provide users with data protection features. He believes this day is not far off.