Bounty

Multichain

Arbitrum

<p class="is-style-lead">The Kyber Network team has confirmed the incident, urging users to promptly withdraw their funds.</p> 
<p>Decentralized exchange protocol <a href="http://crypto.news/tag/kyberswap" target="_blank" rel="noreferrer noopener">KyberSwap</a> has allegedly suffered a hacker attack as more than $45 million worth of crypto has been drained from the project across multiple networks.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">🚨Urgent🚨<br><br>Dear KyberSwap Elastic Users,<br>We regret to inform you that KyberSwap Elastic has experienced a security incident. <br><br>As a precautionary measure, we strongly advise all users to promptly withdraw their funds. Our team is diligently investigating the situation, and we…</p>— Kyber Network (@KyberNetwork) <a href="https://twitter.com/KyberNetwork/status/1727475235342217682?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">November 22, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The Kyber Network team has confirmed the incident in <a href="https://twitter.com/KyberNetwork/status/1727475235342217682" target="_blank" rel="noreferrer noopener">an X post</a>, advising users to “promptly withdraw their funds.” The team also noted that KyberSwap’s aggregator “is not impacted and is operating fully as normal.”</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Kyberswap appears to have suffered from an exploit involving their liquidity pools. The issue does not appear to affect their router contract, thus it should not affect Unibot users' trades. Regardless, Unibot has disabled Kyberswap as an integrated aggregator out of an abundance…</p>— Unibot (@TeamUnibot) <a href="https://twitter.com/TeamUnibot/status/1727471340603711829?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">November 22, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>While the root cause of the attack is yet to be revealed, users suggest that the protocol allegedly suffered an exploit involving its liquidity pools. According to <a href="https://x.com/TeamUnibot/status/1727471340603711829?s=20" target="_blank">Unibot</a>, a crypto trading bot for Telegram, the issue “does not appear to affect their router contract,” implying the incident should not affect Unibot users’ trades.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">.<a href="https://twitter.com/KyberSwap?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@KyberSwap</a> was exploited due to tick manipulation and double liquidity counting.<br>In summary, the attackers borrowed a flash loan and drained the pools with low liquidity. By executing swaps and altering positions, they manipulated the current prices and ticks of the victimized… <a href="https://t.co/wNGORP4CsT" target="_blank">https://t.co/wNGORP4CsT</a> <a href="https://t.co/lIQYe5SHi7" target="_blank">pic.twitter.com/lIQYe5SHi7</a></p>— BlockSec (@BlockSecTeam) <a href="https://twitter.com/BlockSecTeam/status/1727560157888942331?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">November 23, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p> You might also like: <a href="https://crypto.news/kyberswap-ready-to-pay-a-15-bounty-if-hacker-returns-265k-stolen-crypto-funds/"> KyberSwap Ready to Pay a 15% Bounty if Hacker Returns $265K Stolen Crypto Funds </a> </p> 
<p>Analysts at blockchain firm BlockSec <a href="https://twitter.com/BlockSecTeam/status/1727560157888942331" target="_blank" rel="noreferrer noopener">claim</a> the hack was possible due to a “tick manipulation and double liquidity counting.”</p> 
<blockquote class="wp-block-quote"> 
 <p>“In summary, the attackers borrowed a flash loan and drained the pools with low liquidity. By executing swaps and altering positions, they manipulated the current prices and ticks of the victimized pools.”</p> 
 <p>BlockSec</p> 
</blockquote> 
<p>Shortly after the attack, the hacker <a href="https://x.com/officer_cia/status/1727478690085286215?s=20" target="_blank" rel="noreferrer noopener">left an on-chain message</a>, saying they will soon start negotiations with the Kyber Network team. Amid the incident, the total value of funds locked in KyberSwap plunged by almost 84% from $84.9 million down to $13.6 million, according to <a href="https://defillama.com/protocol/kyberswap" target="_blank" rel="noreferrer noopener">data</a> from DefiLlama.</p> 
<figure class="wp-block-image size-large">
 <img decoding="async" loading="lazy" width="1024" height="446" src="https://crypto.news/app/uploads/2023/11/oidsjf-1024x446.png" alt="KyberSwap suffers multichain exploit, resulting in $45m loss - 34" class="wp-image-14219306">
 <figcaption class="wp-element-caption">
  TVL in KyberSwap following the incident | Source: DefiLlama
 </figcaption>
</figure> 
<p>Security analysts at Lookonchain <a href="https://x.com/lookonchain/status/1727503611863998610?s=20" target="_blank" rel="noreferrer noopener">calculated</a> that the hacker stole over 10,000 in wETH (valued at the moment of the attack at $20.7 million), more than 4,000 in wstETH ($9.5 million) and nearly 4 million in ARB (~$4.1 million) among other tokens across Base, Polygon, Optimism, Arbitrum and other networks. </p> 
<p>Users <a href="https://x.com/wasgiventhatday/status/1727576638127566865?s=20" target="_blank" rel="noreferrer noopener">believe</a> the hacker is the same person who <a href="https://crypto.news/north-korean-ties-suspected-in-indexed-finance-treasury-attack/" data-type="link" data-id="https://crypto.news/north-korean-ties-suspected-in-indexed-finance-treasury-attack/">attacked</a> Indexed Finance, referring to the same crypto address spotted in the transaction history of KyberSwap’s operations.</p> 
<p> Read more: <a href="https://crypto.news/kyberswap-unveils-multichain-integration-into-their-system/"> KyberSwap Unveils Multichain Integration Into Their System </a> </p>

KyberSwap suffers multichain exploit, resulting in $45m loss

crypto.news

Other articles published on Nov 23, 2023

How to Revolutionize DeFi Trading With Integral (ITGR)

Teamfight Tactics Unveils Set 10: Remix Rumble with a Musical Twist

Cryptopia is Building with Skale

X Account of Former Binance CEO CZ Gets Temporarily Restricted. Here's What Happened

As Bitcoin Halving Event Approaches, Hash Rate Reaches a New Record!

OpenAI Board Selection Sparks Gender-Competence Debate

Join our free newsletter for daily crypto updates!