Bitcoin
$64,001.37+3.49%
Ethereum
$3,054.47+2.34%
Binance Coin
$557.46+2.84%
Solana
$142.64+4.65%
XRP
$0.51202158+5.40%
Dogecoin
$0.15536201+6.12%
Toncoin
$6.07-9.89%
Cardano
$0.47848826+7.91%
Shiba Inu
$0.00002311+5.96%
Avalanche
$35.08+3.71%
Wrapped Bitcoin
$64,142.08+5.22%
Tron
$0.10977694+1.90%
PlayIconNav
Crypto Prices CoinDesk 20 Index CoinDesk 20 Index
Consensus 2024Price Increase Extension Ends In
00
DAYS
16
HR
13
MIN
31
SEC
Markets

DeFi Lender bZx Loses $8M in Third Attack This Year

An attacker found a way to mint unbacked iTokens that they could then redeem against other cryptos held in lending pools for DeFi lender bZx.

By Paddy Baker
AccessTimeIconSep 14, 2020 at 9:58 a.m. UTC
Updated Sep 14, 2021 at 9:55 a.m. UTC
(Shutterstock)
(Shutterstock)
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Decentralized finance (DeFi) protocol bZx has fallen victim to yet another attack after a bug in its code allowed someone to mint tokens they redeemed for cryptocurrencies on the protocol.

  • Co-founder Kyle Kistner told CoinDesk the company noticed something was wrong on Sunday when a single LINK withdrawal led to a $2.6 million drop in the protocol's total value locked (TVL).
  • The attack basically centered around the protocol's interest-earning iToken that users receive and redeem for crypto deposited into lending pools.
  • Kistner said the attacker exploited a bug that tricked bZx into minting unbacked iTokens subsequently exchanged for cryptocurrencies held in the pools.
  • Per an incident report Sunday, the attacker managed to steal just under 220,000 LINK tokens, 4,507 ETH, 1.76 million USDT, 1.4 million USDC and 670,000 DAI.
  • At current spot prices, this works out as a loss of just over $8 million.
  • That's much more than the $630,000 and $350,000 hacks the protocol suffered in February, which both manipulated oracle price feeds in order to pay back bZx loans for far less than the actual amount.
  • bZx paused the protocol in the aftermath of Sunday's attack so the bug could be patched, and resumed operations hours later.
  • Kistner said the decision was taken in consultation with security experts, who had not instructed the company to shut down for any longer.
  • He added the $8 million lost had already been debited by the protocol's insurance fund and will be paid out once the bZx community had ratified it.
  • The bug managed to remain undetected in two extensive code audits from cybersecurity firms Certik and Peckshield.
  • Kistner declined to comment on the identity of the hacker.

See also: DeFi Project dForce Refunds All Affected Users After $25M Hack

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.

Read more about
HacksDeFibZxCoinFlash