JPEG'd
Hack or exploit on Jul 30, 2023 · Reentrancy Attack
What happened
The NFT lending platform JPEG'd was hacked, and JPEG tokens fell by 40% in a short period of time, with a loss of at least about $10 million. The root cause is re-entry. When the attacker calls the remove_liquidity function to remove liquidity, he adds liquidity by re-entering the add liquidity function. Because the balance update is before re-entering the add_liquidity function, the price calculation is wrong. JPEG'd tweeted that the PETH-ETH curve pool was attacked. The vault contract that allows NFTs to be borrowed is safe and still functioning. NFT and treasury fund security. The JPEG'd contract has not been hacked and is safe. On August 5, JPEG'd tweeted that the DAO multi-signature address confirmed receipt of 5494.4 WETH, and the address owner who recovered funds from the pETH vulnerability received a 10% white hat bounty, which is 610.6 WETH.
Details
- Date
- Jul 30, 2023
- Kind
- Hack or exploit
- Method
- Reentrancy Attack
- How in
- Smart contract bug
- Target
- not stated
- Chains
- not stated
After the theft
- Recovered or seized
- yes, amount not stated
“On August 5, JPEG'd tweeted that the DAO multi-signature address confirmed receipt of 5494.4 WETH, and the address owner who recovered funds from the pETH vulnerability received a 10% white hat bounty, which is 610.6 WETH.” (SlowMist Hacked) - Bounty paid
- yes, amount not stated
“On August 5, JPEG'd tweeted that the DAO multi-signature address confirmed receipt of 5494.4 WETH, and the address owner who recovered funds from the pETH vulnerability received a 10% white hat bounty, which is 610.6 WETH.” (SlowMist Hacked)
Reported by
Related incidents
SwanBluechip, "JPEG'd hack, Jul 30, 2023: $11.4M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htbf86c2e579/ (data as of 2026-10-31).