bZx

What happened

bZx officially tweeted that at 3:28 am Eastern time (15:30, September 13th, Beijing time), we began to study the decline in TVL of the agreement. By 6:18 AM EST (18:30, September 13th, Beijing time), we confirmed that several iTokens had repeated incidents. Lending is temporarily suspended. The duplicate method has been patched from the iToken contract code, and the agreement has resumed normal operation. According to the information of the founder of Compound, there are a total of US$2.6 million in LINK, US$1.6 million in ETH, and US$3.8 million in stablecoins, with a total of US$8 million in assets affected. 1inch co-founder Anton Bukov tweeted that the attacker had stolen about 4,700 ETH in this incident and attached the address of the stolen funds. In response, bZx said that the funds are currently not at risk. The funds listed have been deducted from our insurance fund. On September 16, bZx released an iToken repeat incident report, and the attacker has returned all funds.

Details

Date

Sep 14, 2020

Kind

Hack or exploit

Method

Replay Attack

How in

Smart contract bug

Target

not stated

Chains

Ethereum

After the theft

Victims reimbursed

yes, amount not stated
“The funds listed have been deducted from our insurance fund.” (SlowMist Hacked)

Returned by the attacker

yes, amount not stated
“On September 16, bZx released an iToken repeat incident report, and the attacker has returned all funds.” (SlowMist Hacked)

Reported by

• SlowMist Hacked ↗