DeFi lending protocol bZx hacked twice in four days
|- The overall loss incurred by both the attacks totaled around $954,000.
- The first hack was due to bug exploitation in the bZx smart contract, while an oracle manipulation attack caused the second hack.
DeFi lending protocol bZx has been successfully hacked twice in just four days, incurring a total loss of about $954,000. According to bZx’s report, the first attack took place on February 14, when the team was attending the ETHDenver industry event. The protocol was compromised for the second time on February 18, as per The Block’s report.
During the first attack, the hacker used several DeFi protocols to lend and swap vast quantities of Ether and wrapped Bitcoin (WBTC) in a manner that allowed them to manipulate the prices and profit of the eventual leveraged trade. The attacker first loaned 10,000 Ether (ETH) from dYdX, a lending protocol, and later used 5,500 ETH ($1.46 million) to obtain a 112 WBTC loan (>$1 million) on Compound, another DeFi protocol. Following this, they used bZx’s Fulcrum trading platform to open a 5x leveraged position on the ETH/BTC pair with a 1,300 ETH investment. After that, they used Kyber’s Uniswap to borrow 5,637 ETH and swap them for 51 WBTC. Ultimately, by swapping the 112 WBTC from Compound to 6,671 ETH, the attacker was able to pocket a profit of 1,193 ETH (nearly $318,000). They then paid back the erstwhile borrowed 10,000 ETH to dYdX. The attacker was able to execute this elaborate attack by exploiting a bug in bZx’s smart contract. This bug has since been fixed.
Currently, the details about the second hack are still unclear. A message from Kyle Kistner, the project’s CVO, says that it was an oracle manipulation attack. Oracles are centralized components that provide on-chain applications with external data.
According to the estimates by The Block, the loss suffered totals 2,388 ETH (nearly $636,000). Kistner notes that the team can neutralize the hack and prevent the loss of user funds like they did for the first hack. He also said that the devs will now use ChainLink’s protocol to make the system safer.
Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers.