BingX lost $44.7M after multiple hot wallets were compromised across Ethereum, BNB, and Polygon. Aave’s Repay Adapter was exploited for $56K due to excessive token allowances post-swap. A phishing attack drained $55.5M DAI from 0xf2…48’s Maker Vault. Nexera lost $449K after a malicious NPM package gave attackers access to Fundrs contracts.
On September 19th, the BingX exploit on multiple chains resulted in a $44.7M loss. The root cause of the attack was the compromise of multiple hot wallets across Ethereum mainnet, BNB Chain, and Polygon. The exploit involved more than ten contract addresses. The BingX team acknowledged the incident and confirmed that $1M in stolen funds has been frozen.
Exploit Contract: 0xa88f86E5685FCa7C5D6de0e4D944875b007137b5
Transaction Hash: 0xb5e812e4769a7af5afb6488f499e1ff59be56fbf923b3e9c11f9dd13f9743fbe
On August 28th, the Aave Repay Adapter exploit on multiple chains resulted in a $56K loss. The root cause of the exploit was a logic vulnerability in the private _buyOnParaSwap() function of the ParaSwapRepayAdapter contract. This function approved tokens based on the maxAmountToSwap, but executed swaps with a smaller paraswapData amount. This left a large leftover token allowance for the tokenTransferProxy. The attacker exploited this excessive allowance to withdraw tokens from the contract.
Exploit Contract: 0x02e7b8511831b1b02d9018215a0f8f500ea5c6b3
Transaction Hash: 0xc27c3ec61c61309c9af35af062a834e0d6914f9352113617400577c0f2b0e9de
On August 20th, the exploit of 0xf2B889437F243396b29E829908b5d8ebE2e13048 on the Ethereum mainnet resulted in a $55.5M loss. The root cause was a phishing attack where the victim unknowingly signed a malicious transaction. The transaction allowed the attacker to gain control of the victim’s Maker Vault and transfer $55.5M DAI.
Exploit Contract: 0xf2B889437F243396b29E829908b5d8ebE2e13048
Transaction Hash: 0xf70042bf3ae7c22f0680f8afa078c38989ed475dfbe5c8d8f30a50d4d2f45dc4
On August 7, the Nexera exploit on the Ethereum mainnet resulted in a $449K loss. The root cause of the attack was a Javascript malware called BeaverTail. The malware was hidden as a Node Package Manager (NPM) package. Using the malware, the attacker gained unauthorized access to the Fundrs platform contracts and stole the funds. The Nexera team acknowledged the incident and temporarily paused all transactions.
Exploit Contract: 0xe697949817a45446776376db203c04d31b580a10
Transaction Hash: 0x42330871eb6f1f912103bb4d7a6bc5dec5e4abfb58761386373f43dd29a275ab