Sugar Kingdom Odyssey

Odyssey

Bitcoin

Equalizer

According to a May 14 report from blockchain security platform CertiK, the Alex protocol bridge on the BNB Smart Chain network suffered $4.3 million in suspicious withdrawals just after its contract was suddenly upgraded.
Alex is a Bitcoin layer-2 protocol. According to its official website, it provides decentralized finance applications on Bitcoin. Its bridges are used to transfer assets from other networks, such as BNB Smart Chain and Ethereum, to its own network.
Blockchain data confirms that the Alex deployer account <a href="https://bscscan.com/tx/0x9f1609e34fb37cba820ef4697f3c6b64d3c20ee3427f38c729baab4ae007dabb" target="_blank" rel="noopener nofollow">performed</a> five identical upgrades to the “Bridge Endpoint” contract on BNB Smart Chain beginning at 3:56 pm UTC. Approximately $4.3 million worth of Binance-Pegged Bitcoin (<a href="https://cointelegraph.com/bitcoin-price">BTC</a>), USD Coin (<a href="https://cointelegraph.com/usdc-price-index">USDC</a>), and Sugar Kingdom Odyssey (SKO) were subsequently <a href="https://bscscan.com/tx/0x47e123af93add709bc2516f6a5db057dfbb1d66a75b693cd7980cd3eb28c7357" target="_blank" rel="noopener nofollow">removed</a> from the BNB Smart Chain side of the bridge.
Because the upgrade was performed by the protocol’s deployer account, CertiK labeled the event “a possible private key compromise.”&nbsp;
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/4617cf53-8900-43c0-8270-0f6bf6a0a504.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/CertiKAlert/status/1790432967422083329" target="_blank" rel="noopener nofollow">CertiK</a>
 </figcaption>
</figure>
The upgrade transaction changed the implementation address to one ending in 7058. The new implementation is unverified bytecode, making it unreadable to human beings.
About 48 minutes after these upgrades began, the proxy address for the bridge contract called an unverified function on an address ending in 4848E. This resulted in 16 BTC ($983,000 at current prices), 2.7 million SKO ($75,000) and $3.3 million worth of USDC at 4:44 pm, being moved into the address at 484E.
The attacker may also be attempting to drain funds on other networks. At 5:41 pm, just minutes after the suspicious upgrade on BNB Smart Chain, a similar series of Alex upgrades <a href="https://etherscan.io/tx/0x7d16729dfe35de65c8ea1833192e5cc4647d1515f4323cbfafa03dfb3a192227" target="_blank" rel="noopener nofollow">occurred</a> on Ethereum. In this case, the deployer upgraded the “artist address” to an unverified contract. Immediately afterward, an account ending in 05ed attempted to make two withdrawals from the “team address.” These withdrawals <a href="https://etherscan.io/tx/0x83c6d14c0e0bfb28d70316cfbd17f7b8f822817d80da909c583ed9a8411d3cc5" target="_blank" rel="noopener nofollow">failed</a>, producing a “not owner” error. 
The 05ed account had no history before May 10. It created one unverified contract on May 10 and two more on May 14, indicating that it may be under the control of a malicious user.
At the time of publication, the Alex team has not confirmed the exploit or commented on the incident.
The Alex bridge wasn’t the only protocol to face a potential exploit in May. On May 13, decentralized exchange Equalizer announced that it <a href="https://cointelegraph.com/news/equalizer-dex-hacker-drains-funds">had lost more than 2,000</a> of its own tokens from an attacker who siphoned them away in small increments over several days. The Gnus.ai hack on May 6 also <a href="https://cointelegraph.com/news/gnus-discord-hack-causes-1-27-million-losses">resulted in $1.27 million</a> worth of losses.
Related: <a href="https://cointelegraph.com/news/certik-discovered-5-million-security-flaw-wormhole-bridge-aptos">CertiK discovered $5M security flaw in Wormhole bridge on Aptos</a>

Alex bridge on BNB Smart Chain drained of $4.3M after suspicious upgrade — CertiK

Cointelegraph

Other articles published on May 14, 2024

Tether Freezes $5.2 Million in Phishing Scam

SEC’s Hostile Stance Threatens US Crypto Innovation

Draper University To Invest in the Stellar Ecosystem with New Accelerator Programs Focused on AI ...

Memecoin Mania: PEPE2.0, MAGA, PONKE Lead Meme Coin Rally

Cardano (ADA) Price Soars: Top Analyst Predicts Potential 1,500% Increase

Cardano (ADA) Price May Fall Below Support as Bearish Pressure Mounts

Join our free newsletter for daily crypto updates!