WETH

Security

Yield

In a targeted exploit, decentralized exchange (DEX) aggregator and liquidity protocol KyberSwap, which serves as the main protocol in the Kyber Network’s liquidity hub, suffered a significant <a href="https://bitcoinist.com/kyberswap-exploit-50-million-loss/" target="_blank" rel="noopener ">security breach</a>.&nbsp; 
On November 23, 2023, KyberSwap was attacked, resulting in the theft of approximately $54.7 million, <a href="https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a" target="_blank" rel="noopener nofollow">according </a>to intelligence provided by the SlowMist Security Team.&nbsp;Now, more than seven days after the initial attack, the hacker has issued bold and audacious demands. 
<h2 id="critical-vulnerability-in-liquidity-management-system">Critical Vulnerability In Liquidity Management System</h2> 
The <a href="https://bitcoinist.com/justin-sun-platform-hacked-commits-covering-losses/" target="_blank" rel="noopener ">attack </a>involved a series of meticulously planned steps. The attacker began by borrowing 2000 Wrapped Ether (WETH) through a flash loan from the AAVE protocol.&nbsp; 
With 6.8496 WETH, the attacker conducted a swap for frax Ether (frxETH) in the KyberSwap pool, intentionally causing the frxETH price to exceed the range of all liquidity providers’ positions.&nbsp; 
Subsequently, the attacker added liquidity of 0.006948 frxETH and 0.1078 WETH within a specified price range. Manipulating the liquidity amount within this range to be 74692747583654757908, the attacker strategically controlled the liquidity to align with their subsequent attack stages. 
The attacker then utilized 387.17 WETH to swap for 0.005789 frxETH, significantly increasing the current price value. Finally, the attacker performed a reverse swap, exchanging 0.005868 frxETH for 396.2 WETH at a price slightly higher than the square root Price (sqrtP) of tick 111310.&nbsp; 
The attacker <a href="https://bitcoinist.com/poloniex-crypto-exchange-hacked/" target="_blank" rel="noopener ">profited</a> from the reverse swap by taking advantage of this manipulation, acquiring approximately 9 more WETH than initially exchanged in the forward swap. 
According to the SlowMist team, the attack’s root cause was the miscalculation of the required token amounts for exchanges based on current and boundary tick prices.&nbsp; 
Due to KyberSwap Elastic’s Reinvestment Curve, the liquidity inadvertently increased due to compounded fees, resulting in a calculated amount larger than expected. This excess liquidity covered the<a href="https://bitcoinist.com/bitfinex-minor-security-incident-customer-support/" target="_blank" rel="noopener "> user’s exchange needs</a>, but the actual price had already crossed the boundary tick.&nbsp; 
Consequently, KyberSwap failed to update the liquidity, leading to a duplication of liquidity increase during the reverse exchange across the boundary tick. This flaw allowed the attacker to obtain more tokens than initially anticipated. 
<h2 id="kyberswap-must-yield-authority-and-assets">&nbsp;KyberSwap Must Yield Authority And Assets</h2> 
In an unexpected turn of events, the hacker issued a second on-chain <a href="https://x.com/esatoshiclub/status/1730217617716068376?s=20" target="_blank" rel="noopener nofollow">message </a>on November 30, following an initial message on November 28. 
The demands include complete executive control over KyberSwap, temporary full authority and ownership over the governance mechanism (KyberDAO) to enact legislative changes, and surrender of all assets encompassing shares, equity, and tokens.&nbsp; 
<img loading="lazy" decoding="async" class="size-large wp-image-267232" src="https://bitcoinist.com/wp-content/uploads/2023/11/GALk1WdXIAAVGVO.png?w=543&amp;resize=543%2C660" alt="KyberSwap" width="543" height="660" srcset="https://bitcoinist.com/wp-content/uploads/2023/11/GALk1WdXIAAVGVO.png?w=903 903w, https://bitcoinist.com/wp-content/uploads/2023/11/GALk1WdXIAAVGVO.png?w=345 345w, https://bitcoinist.com/wp-content/uploads/2023/11/GALk1WdXIAAVGVO.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2023/11/GALk1WdXIAAVGVO.png?w=543&amp;resize=543%2C660 543w, https://bitcoinist.com/wp-content/uploads/2023/11/GALk1WdXIAAVGVO.png?w=750 750w" sizes="(max-width: 543px) 100vw, 543px" data-recalc-dims="1"> 
The hacker also <a href="https://bitcoinist.com/lastpass-hack-4-4-million-asset-migration-advised/" target="_blank" rel="noopener ">promises </a>a buyout of executives at a fair valuation, a doubling of employee salaries under the new regime, and a 12-month severance package with full benefits for employees who choose to leave. 
Furthermore, the hacker addresses token holders and investors, assuring them that their tokens will regain value under the proposed treaty. The hacker even pledges to transform Kyber into an entirely new crypto project, surpassing its current ranking as the 7th most popular DEX.&nbsp; 
Liquid pool (LP) participants will also receive a rebate covering 50% of their recent market-making losses. The hacker has set a firm deadline of December 10th for his demands to be met, claiming that he can be contacted via Telegram with the handle “@Kyber_Director.” 
The next steps for the protocol’s leaders remain uncertain as they grapple with the latest developments and the urgent need to address them within a timeframe of just over 10 days, with no official response to the hacker as of this writing. 
<img loading="lazy" decoding="async" class="size-large" src="https://www.tradingview.com/x/JIfekJNU/" alt="KyberSwap" width="1815" height="858"> 
Featured image from Shutterstock, chart from TradingView.com

KyberSwap Hacker Demands Full Control, Sets December 10th Deadline

Table of Contents

Bitcoinist

Other articles published on Nov 30, 2023

PEPE Bulls Struggle To Reverse Trend Amid Growing Selling Pressure

Top Crypto Gainers Today on DEXTools – MIND, BABYFROGE, BETROCK

Celsius Opens Withdrawal Options for Eligible Cryptocurrency Investors

Binance And Banking Partner Collaborate To Establish World’s First Triparty Crypto Arrangement

The Impending Bitcoin Retreat: Analyzing Market Movement and Predictions

Round Three: Robinhood Sets Sights on UK Market with 24H Trading and 6,000 US Stocks

Join our free newsletter for daily crypto updates!