Decentralized exchange Kiloex suffered a $7 million exploit. Security firm Cyvers identified a potential price oracle vulnerability as the cause. Kiloex Calls for Blacklisting of Attacker’s Address Kiloex, a decentralized exchange (DEX) on the BNB Smart Chain, confirmed it was the victim of a $7 million digital fund exploit. Blockchain security firm Cyvers said the […]

Baumz, a prominent decentralized perpetual exchange, has officially partnered with KiloEx, another notable perpetual DEX. This partnership aims to enhance perpetual transactions within the blockchain market. According to Baumz's official social media announcement, the partnership will combine the technological strengths of both companies to improve liquidity flows, system transparency, and execution speed. This move therefore reaffirms the growing trend of cutting-edge collaborations to facilitate the expansion of decentralized derivatives.

Decentralized exchange (DEX) KiloEx has offered the hacker who exploited $7.5 million in crypto from its platform a 10% white hat bounty.  On April 15, KiloEx posted an offer directed to the hacker who stole millions from the DEX. KiloEx said it had worked with law enforcement, cybersecurity agencies and exchanges to uncover information about the hacker’s activities.  The DEX also shared wallet addresses linked to the hackers that the DeFi platform and other organizations are actively monitoring. KiloEx said they were prepared to freeze the stolen funds. However, the DEX offered the hacker $750,000 in exchange for returning 90% of the stolen assets.  KiloEx said that it would treat the incident as a white hat exploit if the hacker returned the funds. Hacker stole $7.5 million from KiloEx On April 14, cybersecurity companies reported that an exploiter looted the platform through a price oracle vulnerability. A report from PeckShield said that about $3.3 million in Base, $3.1 million opBNB and $1 million BSC tokens were taken.  The blockchain security company said that the information used by a smart contract to determine price assets was manipulated, which led to the exploit.  In response to the attack, the platform suspended its DEX. The platform also said the exploit had been contained.  Related: Ethical hacker intercepts $2.6M in Morpho Labs exploit KiloEx to pursue legal action if the hacker doesn’t return the funds The DEX added that it would drop the matter and publicly acknowledge that the incident is settled if the hacker agrees to return the funds. KiloEx wrote: “We will tweet about this resolution, acknowledging your cooperation and closing the case without further action.” The DEX informed the hacker to contact its email or send an onchain message if they accepted the offer. If the hacker doesn’t accept the offer, the DEX said it would escalate the matter with the relevant law enforcement and pursue the investigation with its cybersecurity partners.  “Your identity and activities will be exposed to relevant authorities. We will pursue legal action relentlessly. The choice is yours. Act now to avoid irreversible consequences,” KiloEx wrote.  Magazine: Illegal arcade disguised as … a fake Bitcoin mine? Soldier scams in China: Asia Express

Decentralized exchange KiloEX has confirmed it has suspended usage of its platform and is tracing stolen funds after suffering a $7.5 million exploit.  The exploit has been contained, with use of the platform suspended and an investigation underway, the KiloEX team said in an April 14 statement to X. “The team has immediately suspended platform usage and is working with security partners to trace the flow of funds,” KiloEX said.  “We are analyzing the attack vector and affected assets. We are collaborating with ecosystem partners to trace and recover funds where possible.”  Source: KiloEX A bounty program and a full report on how the exploit occurred is also in the works, according to KiloEX.  In an update, the KiloEX team said it was collaborating with BNB Chain, Manta Network, and cybersecurity firms Seal-911, SlowMist and Sherlock in an effort spanning “multiple ecosystems.”  “Our investigation has confirmed that the stolen assets are currently being routed through zkBridge and Meson,” KiloEX said.  “We are urgently attempting to engage with both protocols to halt ongoing transactions and prevent additional losses.”  KiloEX attacker exploited price oracle issue, say analysts  Cybersecurity firm PeckShield said in an April 14 post to X the exploiter looted $7.5 million in total, $3.3 million Base, $3.1m opBNB and $1m BSC.  The firm has speculated the exploit is likely a “price oracle issue,” where the information used by a smart contract to determine the price of an asset is manipulated or inaccurate, leading to the exploit.  “Our initial analysis on one transaction exploit indicates a price oracle issue,” PeckShield said.  Source: PeckShield “The hacker exploits it to create a new position with initial given ETH/USD price of 100 and then immediately close the position with inflated ETH/USD price of 10000, netting the $3.12m profit in one single transaction.”  Chaofan Shou, co-founder of blockchain analytics firm Fuzzland, also weighed in, speculating the exploit was likely due to a price oracle issue. “Anyone can change the Kilo’s price oracle. They did verify that the caller shall be a trusted forwarder, though, but didn’t verify the forwarded caller,” Shou said.  Shou added it was a “very simple vulnerability” when a user asked about the complexity of the exploit.  Source: Chaofan Shou The news has sent the KiloEX’s native token, Kilo, plunging over 27% to trade at $0.03596, according to CoinGecko. It’s still down over 78% from its all-time high of $0.1648, which it hit on March 27. Related: Mantra CEO says OM token recovery ‘primary concern’ but in early stages KiloEx was established in 2023 and is backed by Binance Labs, which is a lead investor and strategic partner.  This exploit comes just days after the exchange announced a partnership with Dubai-based Web3 venture capitalist firm DWF Labs on April 13, which promised to expand KiloEx's market presence and accelerate growth.  On March 25, DWF Labs launched a $250 million Liquid Fund to accelerate the growth of mid- and large-cap blockchain projects and drive real-world adoption of Web3 technologies. Magazine: Bitcoin eyes $100K by June, Shaq to settle NFT lawsuit, and more: Hodler’s Digest, April 6–12

The hacker who exploited a decentralized exchange, KiloEx, for $7.5 million has unexpectedly returned all the money that was stolen, just four days after the hack. KiloEx halted operations for a wh…

Decentralized exchange (DEX) KiloEx said it will compensate traders and stakers hurt by a $7.5 million exploit that temporarily shut down the platform earlier in April. In an April 24 announcement, KiloEx said traders who had positions open while the platform was suspended would get full compensation if their losses increased or profits decreased. The platform said it would pay the difference.  KiloEx urged traders to close their positions immediately once the platform resumes operations, as delaying could affect their profit and losses, which may then impact the compensation amount. “Please close your position as soon as possible after the platform resumes. Compensation will be calculated based on the platform’s resume time,” KiloEx stated. Source: KiloEx Stakers’ principal and earnings remain unaffected For the platform’s Hybrid Vault stakers, KiloEx said that the stolen funds were fully reinjected into the vault. As a result, staker earnings and principal will remain unaffected. However, KiloEx said it will still provide an additional 10% annual percentage yield (APY) as a bonus for eligible stakers. The bonus APY will be awarded to users who had funds in the vault prior to the platform’s resumption. On April 15, KiloEx offered a 10% bounty to the hacker who stole the funds from the platform. The DEX said that the hacker could keep $750,000 as a white hat bounty if they decided to return 90% of the stolen funds. The platform threatened to expose the hacker’s identity and take legal action if they did not comply.  Shortly after, security platforms flagged transactions indicating that the KiloEx hacker returned the stolen funds. On April 18, the DEX said it would withdraw all legal action against the hacker and reward them with a 10% white hat bounty.  Related: Mantra OM token crash exposes ‘critical’ liquidity issues in crypto KiloEx hacker exploited a price oracle vulnerability On April 14, KiloEx suspended its platform after containing the exploit that led to the $7.5 million in losses. Security firm PeckShield said the attacker likely exploited a price oracle vulnerability that allowed them to inflate the prices to gain more profit than they should have.  In a post-mortem published by KiloEx, the platform confirmed that the attacker exploited a permissionless function. The DEX said the attacker crafted a request that only authorized entities should have been able to do.  Using this, the attacker opened a position at an “artificially low price.” This was followed by closing the position at a higher price, providing illegitimate profit to the attacker.  Magazine: Ethereum maxis should become ‘assholes’ to win TradFi tokenization race