BiFi
Hack or exploit on Jul 10, 2022 · Private Key Leakage
What happened
BIFROST officially released a report saying that the BTC address registration server of the BiFi service was attacked. According to the analysis, the attack was limited to the BTC address registration server, and neither the smart contract nor the BiFi protocol detected the vulnerability. BiFi issues and uses an address for each user who deposits BTC. The deposit addresses are signed and delivered to the address issuing server and the addresses are reflected on BiFi only in the case when the signature is verified. In the attack, the server key of the address issuing server was exposed and the attacker was able to self-sign their own deposit address. Since the attacker could generate a valid signature on the deposit address, BiFi mistakenly recognized the attacker’s BTC transfer as a BTC deposit into BiFi. As a result, the attacker was able to borrow 1,852 ETH with fake deposit.
Details
- Date
- Jul 10, 2022
- Kind
- Hack or exploit
- Method
- Private Key Leakage
- How in
- Keys, accounts and infrastructure
- Target
- not stated
- Chains
- Ethereum, Bitcoin
Reported by
Related incidents
Luke Dashjr 2022 · Hack or exploit · $3.6M
BXH 2022 · Hack or exploit · $2.5M
Arthur 2022 · Hack or exploit · $1.6M
Eden Network 2022 · Hack or exploit · undisclosed
SwanBluechip, "BiFi hack, Jul 10, 2022: $2.3M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht9322170116/ (data as of 2026-10-31).