aBNBc was attacked by a Hacker, and the minting function vulnerability caused a big dump of the Token.

robot
Abstract generation in progress

On December 2, a laboratory discovered through on-chain data monitoring that the aBNBc project was attacked by a hacker, resulting in a large-scale token issuance transaction. The hacker successfully issued a large number of aBNBc tokens, some of which were exchanged for BNB on a decentralized trading platform, while others were kept in a wallet. In addition, the hacker also used mixing tools for fund transfers. This attack caused the liquidity pool of aBNBc tokens to be depleted, leading to a big dump in the coin price, while the attacker used the issued tokens for collateralized lending, causing losses to the lending platform.

On-chain analysis of the Ankr hacking incident: where did 100 trillion aBNBc issuance come from?

After analyzing multiple transaction data, it was found that despite different caller addresses, they all resulted in token issuance. The project had conducted a contract upgrade before being attacked, and the upgraded logic contract's issuance function lacked permission checks.

on-chain analysis of Ankr hacking incident: Where did the 100 trillion aBNBc issuance come from?

The attacker invoked a specific function in the logic contract through a proxy contract. Due to the lack of permission verification in that function, a large amount of aBNBc tokens were issued. After the attack, the project team updated the logic contract again, adding a permission check mechanism to the issuance function in the new version.

on-chain analysis of the Ankr hacking incident: where did the 100 trillion aBNBc increase come from?

Currently, the hacker has exchanged part of the newly issued aBNBc for BNB and transferred it, while a large amount of remaining aBNBc is still stuck in the attacker's Wallet.

on-chain analysis of the Ankr hacking incident: where did the 100 trillion aBNBc increase come from?

The attack primarily stemmed from the contract upgrade, where the minting function in the new logic contract lacked permission checks, allowing the Hacker to indiscriminately mint Tokens. It is currently unclear whether untested and unaudited contract code was used or if the Hacker upgraded the contract due to a private key leak.

This event reminds users and project parties to properly safeguard their wallet private keys and mnemonic phrases, avoiding casual storage. At the same time, when upgrading contracts, comprehensive security testing must be conducted to prevent similar risks.

ANKR-0.01%
BNB-0.57%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • 5
  • Repost
  • Share
Comment
0/400
OldLeekMastervip
· 1h ago
Suckers have been played for suckers again, right?
View OriginalReply0
NFTArtisanHQvip
· 08-14 19:27
yet another defi project falls victim to the aesthetics of poor smart contract design... tbh quite poetic
Reply0
ZenZKPlayervip
· 08-14 19:22
Another project has gone down...
View OriginalReply0
DancingCandlesvip
· 08-14 19:14
Again, the permission check hasn't been done, right?
View OriginalReply0
OffchainWinnervip
· 08-14 19:12
Another project ruined by an upgrade, tsk tsk.
View OriginalReply0
Trade Crypto Anywhere Anytime
qrCode
Scan to download Gate app
Community
English
  • 简体中文
  • English
  • Tiếng Việt
  • 繁體中文
  • Español
  • Русский
  • Français (Afrique)
  • Português (Portugal)
  • Bahasa Indonesia
  • 日本語
  • بالعربية
  • Українська
  • Português (Brasil)