ByBit, ODOS, and BBX Hacked: $1.5B Drained via Social Engineering, Signature Bypass, and Burn Exploit

ByBit lost $1.5B after signers unknowingly approved a contract upgrade with hidden backdoors. ODOS Protocol suffered a $50K hit from a signature validation flaw using precompiled contracts. BBX’s flawed burn mechanism let an attacker spam zero-amount transfers, draining $12K through price manipulation.

In Brief

• BBX lost $12K due to a burn mechanism flaw.
• ByBit suffered a $1.5B loss due to a social engineering attack.
• ODOS Protocol lost $50K due to an input validation vulnerability.

Hacks Analysis

BBX | Amount Lost: $12K

On March 20, the BBX exploit on the Binance Smart Chain resulted in a $12,000 loss due to a flaw in the _transfer() function. The attacker sent amount=0 transfers to trigger the burn mechanism, moving tokens from the liquidity pool to the 0xdead address. Each call reduced the pool’s supply and updated reserves via sync(), manipulating the price. The function’s time check, if (block.timestamp >= lastBurnTime + lastBurnGapTime), failed to stop same-block spamming since block.timestamp stays constant within a block. The attacker profited by artificially reducing the token supply and inflating the price.

Exploited Contract (on BSC): 0x67ca347e7b9387af4e81c36cca4eaf080dcb33e9

Transaction: 0x0dd486368444598610239b934dd9e8c6474a06d11380d1cfec4d91568b5ac581

ByBit | Amount Lost: $1.5B

On February 21, the Bybit exploit on the Ethereum Mainnet resulted in a $1.5B loss due to a social engineering attack. The exploit involved injecting malicious JavaScript into the UI and tricking signers into approving a routine transfer that hid a contract upgrade. The upgrade added backdoor functions, letting the attacker steal 401K ETH across 39 addresses.

One of the exploiter contracts: 0x4571bd67d14280e40bf3910bd39fbf60834f900a

ODOS Protocol | Amount Lost: $50K

On January 23, 2025, the ODOS Protocol exploit on Base caused a $50K loss. The root cause of the exploit was an insufficient input validation in the OdosLimitOrderRouter’s isValidSigImpl() function. The code allowed deploying new contracts via create2Factory if the _signer’s code length was zero. The attacker used the 0x4 pre-compiled contract (zero length), to pass IERC1271Wallet.isValidSignature() and bypass the signature check. The attacker sent unverified factoryCalldata with an ERC20.transfer to steal tokens.

Exploited Contract (on Base): 0xb6333e994fd02a9255e794c177efbdeb1fe779c7

Transaction: 0xd10faa5b33ddb501b1dc6430896c966048271f2510ff9ed681dd6d510c5df9f6

‍