1 year ago
The OKX DEX Aggregator faced a important information breach involving an outdated astute declaration connected Dec. 12. This incidental resulted successful measures by OKX to unafraid idiosyncratic assets and revoke permissions for the compromised contract. The breach, resulting successful the nonaccomplishment of astir $370,000, has prompted the institution to denote it volition reimburse affected users arsenic they coordinate with authorities to way down the stolen funds. A broad reappraisal is present successful advancement to debar specified vulnerabilities successful the future.
An authoritative connection from the OKX web3 squad stated,
“We regret to pass you that a deprecated astute declaration connected OKX Dex has been compromised. We person taken contiguous enactment to unafraid each idiosyncratic funds and revoke the declaration permissions.
We are moving with applicable agencies to find the stolen funds and volition reimburse affected users with $370k. A thorough reappraisal is underway to forestall akin incidents. Our apologies for immoderate inconvenience caused.”
Blockchain information steadfast SlowMist identified a imaginable leak of the backstage cardinal of the Proxy Admin Owner associated with the OKX DEX. A series of suspicious activities was observed, opening with upgrading the DEX Proxy declaration to a caller implementation. This caller declaration had the capableness to straight telephone the claimTokens relation of the DEX contract, which led to unauthorized token transfers.
The DEX Proxy was upgraded again aboriginal that evening, continuing the illicit token transfers. Approximately 430,000 tokens were stolen during this period, suggesting that the breach was owed to the leakage of the Proxy Admin Owner’s backstage key. The DEX Proxy has been removed from the trusted database arsenic a remedial step.
Tokens stolen include notable projects specified arsenic USDC, USDT, Pepe, WETH, Rollbit, SLP, and SHIBA INU crossed a full of 31 transactions into the wallet present labeled arsenic “OKX Exploiter 2” connected Etherscan.
Security steadfast Cyvers indicated that the full estimated nonaccomplishment could beryllium arsenic precocious arsenic $1.1 million, with portion of the stolen funds being deposited to Railgun and distributed to assorted externally owned accounts (EOAs). The attacker was reportedly funded by Tornado Cash.
The station OKX promises idiosyncratic reimbursement pursuing DEX hack owed to deprecated astute contract appeared archetypal connected CryptoSlate.
English (US) 