<p>According to on-chain data, the decentralized exchange system KyberSwap looks to have been the victim of a $47 million hack. The funds came through the company’s Elastic Pools liquidity solution.</p>
<p>Funds were abruptly transferred from protocol-associated wallets into a single wallet, as initially reported by X user Spreek.</p>
<h2 class="wp-block-heading" id="kyberswap-dex-suffers-millions-in-losses">KyberSwap DEX suffers millions in losses</h2>
<p>In the latest decentralized financial hack, around $47 million in various crypto coins appear to have been taken from the decentralized KyberSwap exchange.</p>
<p>The Kyber Network team informed its users on November 23 via an X (Twitter) post that KyberSwap Elastic “has experienced a security incident.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">🚨Urgent🚨<br><br>Dear KyberSwap Elastic Users,<br>We regret to inform you that KyberSwap Elastic has experienced a security incident. <br><br>As a precautionary measure, we strongly advise all users to promptly withdraw their funds. Our team is diligently investigating the situation, and we…</p>— Kyber Network (@KyberNetwork) <a href="https://twitter.com/KyberNetwork/status/1727475235342217682?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">November 22, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>According to on-chain data, the attacker is mostly stealing funds in Ether, wrapped ether (wETH), and USDC. The attacker also targeted multiple cross-chain KyberSwap deployments, stealing approximately $20 million from Arbitrum, $15 million from Optimism, and $7 million from Ethereum.</p>
<p>As a precaution, the exchange advised users to withdraw their funds while it investigated the situation. On-chain sleuths have ruled out a fault in the DEX’s approval authorization code, implying that the theft is a targeted attack against the liquidity provider pools itself.</p>
<p><a href="https://etherscan.io/address/0xc9b826bad20872eb29f9b1d8af4befe8460b50c6" rel="noopener noreferrer nofollow" target="_blank">Blockchain sleuths</a> identified the affected and exploiter wallet addresses, which were still operational as of late. According to DeFiLlama, the DEX currently has $22.23 million in total value locked (TVL), down from about $80 million prior to the hack.</p>
<h2 class="wp-block-heading" id="the-hacker-s-demands">The hacker’s demands</h2>
<p>The following appeared in a transaction that the perpetrator purportedly sent: “Dear Kyberswap Developers, Employees, DAO members, and LPs, Negotiations will start in a few hours when I am fully rested. Thank you.” In addition, the perpetrator sought out, “How is Ontario this time of year?”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Kyberswap exploiter reaches out with a message: <br>Dear Kyberswap Developers, Employees, DAO members and LPS, Negotiations will start in a few hours when I am fully rested. Thank you. <a href="https://t.co/btYt5jRIL8" rel="noopener noreferrer nofollow" target="_blank">pic.twitter.com/btYt5jRIL8</a></p>— Dip Catcher Ⓜ️❇️🟠🎲🍀🛡🅿️ (@TantoNomini) <a href="https://twitter.com/TantoNomini/status/1727552360334098454?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">November 23, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>KyberSwap Elastic allows liquidity providers to select their preferred price ranges while automatically compounding their yields.</p>
<p>According to DefiLlama data, KyberSwap’s total value locked (TVL) dropped by 68% in a matter of hours, and about $78 million left the protocol as a result of the attack and user withdrawals. Its TVL is currently $27 million, down from a peak of $134 million in 2023.</p>
<p>According to 0xngmi, a pseudonymous employee at crypto data site DefiLlama, on X said: “I looked into the [transaction] and dont think it’s an approval issue with kyber aggregator, seems like hacker is just draining the kyber [liquidity provider] pools.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">i looked into the tx and dont think its an approval issue with kyber aggregator, seems like hacker is just draining the kyber LP pools (TVL is 72M)</p>— 0xngmi (@0xngmi) <a href="https://twitter.com/0xngmi/status/1727467421978526004?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">November 22, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>0xngmi adds that the protocol locks in a total of $72 million worth of value. At this time, there appears to be little to no effect on this.</p>
<p>It is becoming progressively more prevalent <a href="https://www.cryptopolitan.com/dydxs-9m-hack-risk-management-under-scrutiny/" rel="noopener noreferrer nofollow">for hackers </a>to tease their targets by having them sign transactions with lengthy text sequences as part of decentralized finance exploits.&nbsp;</p>
<p>Adam Cochran, general partner at Cinneamhain Ventures, said on X, “Looks like the Kyber exploits is flash loans and some sort of math/rounding issue. Each [transaction] is starting with an ETH balance coming in, looped mint/redeem/swap.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Looks like the Kyber exploits is flash loans and some sort of math/rounding issue.<br><br>Each tx is starting with an ETH balance coming in, looped mint/redeem/swap.<br><br>So likely not a risk to approvals from non-LPs but worth staying frosty</p>— Adam Cochran (adamscochran.eth) (@adamscochran) <a href="https://twitter.com/adamscochran/status/1727469209737732459?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">November 22, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>The perpetrator of the $200 million breach that targeted Euler Finance returned additional funds to the protocols in early March of this year. In a succession of messages published on the blockchain, the attacker appeared to offer an apology.</p>
<p>In a separate blockchain message, the perpetrator, who is currently identified as Jacob, stated that they had every intention of returning the entire amount of funds to Euler.</p>

KyberSwap DEX loses $48M – Here are the hacker’s demands

Table of Contents

Cryptopolitan_News

Other articles published on Nov 23, 2023

WOOFi Now Supports Bitget Wallet Connectivity

Apes! Kirim 55 BTC, Biaya Transaksinya 83 BTC (Rp49 Miliar)

How Sam Altman Can Shape Remote Hiring in Web3 and Crypto

AVAX rises following Onyx collaboration, InQubeta (QUBE) and Fetch.AI (FET) among top AI cryptos ...

60M+ HT Sent to HTX Exchange Platform Following Hack

Top 5 Underrated Cryptos With A 100x Potential In 2024

Join our free newsletter for daily crypto updates!