Sunray Finance, Fire Token, and OnyxDAO Drained via Key Compromise, Launch-Time Burn Flaw, and Exchange Rate Abuse

Sunray Finance lost $2.8M after a private key leak enabled minting of 200T SUN tokens. Fire Token was exploited seconds post-launch via a flawed burn-on-transfer mechanism. OnyxDAO suffered a $3.8M loss after low liquidity let an attacker spike the oETH exchange rate through Compound-style manipulation.

In Brief

• Sunray Finance’s private keys were compromised.
• Fire Token contract suffered a price manipulation attack within seconds after launch.
• Low liquidity in Onyx contract allowed the attacker to manipulate price exchange.

Hacks Analysis

Sunray Finance | Amount Lost: $2.8M

On October 31st, the Sunray Finance exploit on the Arbitrum chain resulted in a $2.8M loss. The root cause was a private key compromise, enabling the attacker to mint 200 trillion SUN tokens. The exploit was executed shortly after Sunray Finance’s management contract upgrade. Sunray Finance has confirmed that the exploit involved newly minted coins and no individual user wallets were directly affected.

Exploited Contract (on Arbitrum): 0xb1bbe57f5c474996a84274f0078a2411e1a65b8a

Transaction Hash: 0x6bf01fc425d2591ac34d41b6a193580079e2506206405841f9cb38881fbb74b2

Fire Token | Amount Lost: $24K

On October 1st, the FireToken exploit on the Ethereum mainnet resulted in a $24K loss within seconds of launch. The root cause was a flaw in the token-burning mechanism during transfers to the Uniswap liquidity pool. This allowed the attacker to manipulate the pool’s balance by reducing the supply and artificially inflating the token price. Specifically, the attacker called the private _transfer() function that transferred a portion of tokens to a ‘DEAD_ADRESS’ (burnt tokens).

Exploited Contract: 0x18775475f50557b96c63e8bbf7d75bfeb412082d

Transaction Hash: 0xd20b3b31a682322eb0698ecd67a6d8a040ccea653ba429ec73e3584fa176ff2b

Onyx | Amount Lost: $3.8M

On October 19th, the OnyxDAO exploit on the Ethereum mainnet resulted in a $3.8M loss. The attacker used a Compound V2 vulnerability in Onyx’s low-liquidity market to manipulate exchange rates. They took a 2,000 ETH flash loan from Balancer, depositing 1,999.5 ETH into the Onyx Ether contract. By donating large amounts to a low liquidity contract and redeeming nearly all ETH, the attacker inflated the exchange rate. OnyxDAO acknowledged the incident and is exploring recovery options.

Exploited Contract: 0x2ccb7d00a9e10d0c3408b5eefb67011abfacb075

Transaction Hash: 0x46567c731c4f4f7e27c4ce591f0aebdeb2d9ae1038237a0134de7b13e63d8729

‍