DeFi Lender bZx Loses $8M in Third Attack This Year
An attacker found a way to mint unbacked iTokens that they could then redeem against other cryptos held in lending pools for DeFi lender bZx.
Sep 14, 2020 at 9:58 a.m. UTCUpdated Aug 19, 2021 at 4:18 a.m. UTC
:format(webp)/cloudfront-us-east-1.images.arcpublishing.com/coindeskuat/K7XUIUM3OBAMJHLXOOWMDMY6FM.jpg)
Decentralized finance (DeFi) protocol bZx has fallen victim to yet another attack after a bug in its code allowed someone to mint tokens they redeemed for cryptocurrencies on the protocol.
- Co-founder Kyle Kistner told CoinDesk the company noticed something was wrong on Sunday when a single LINK withdrawal led to a $2.6 million drop in the protocol's total value locked (TVL).
- The attack basically centered around the protocol's interest-earning iToken that users receive and redeem for crypto deposited into lending pools.
- Kistner said the attacker exploited a bug that tricked bZx into minting unbacked iTokens subsequently exchanged for cryptocurrencies held in the pools.
- Per an incident report Sunday, the attacker managed to steal just under 220,000 LINK tokens, 4,507 ETH, 1.76 million USDT, 1.4 million USDC and 670,000 DAI.
- At current spot prices, this works out as a loss of just over $8 million.
- That's much more than the $630,000 and $350,000 hacks the protocol suffered in February, which both manipulated oracle price feeds in order to pay back bZx loans for far less than the actual amount.
- bZx paused the protocol in the aftermath of Sunday's attack so the bug could be patched, and resumed operations hours later.
- Kistner said the decision was taken in consultation with security experts, who had not instructed the company to shut down for any longer.
- He added the $8 million lost had already been debited by the protocol's insurance fund and will be paid out once the bZx community had ratified it.
- The bug managed to remain undetected in two extensive code audits from cybersecurity firms Certik and Peckshield.
- Kistner declined to comment on the identity of the hacker.
STORY CONTINUES BELOW
13:18
Bitcoin Mining in the U.S. Will Become 'a Lot More Decentralized': Core Scientific CEO
05:10
Binance to Discontinue Its Nigerian Naira Services After Government Scrutiny
04:07
The first video of the year 2024
40:07
The last regression video of the year 3.67.0
:format(webp)/downloads.coindesk.com/arc/failsafe/user/1x1.png)