Share this article
DeFi Lender bZx Loses $8M in Third Attack This Year
An attacker found a way to mint unbacked iTokens that they could then redeem against other cryptos held in lending pools for DeFi lender bZx.
By Paddy Baker
Updated Sep 14, 2021, 9:55 a.m. Published Sep 14, 2020, 9:58 a.m.
Make us preferred on Google
Decentralized finance (DeFi) protocol bZx has fallen victim to yet another attack after a bug in its code allowed someone to mint tokens they redeemed for cryptocurrencies on the protocol.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
- Co-founder Kyle Kistner told CoinDesk the company noticed something was wrong on Sunday when a single LINK withdrawal led to a $2.6 million drop in the protocol's total value locked (TVL).
- The attack basically centered around the protocol's interest-earning iToken that users receive and redeem for crypto deposited into lending pools.
- Kistner said the attacker exploited a bug that tricked bZx into minting unbacked iTokens subsequently exchanged for cryptocurrencies held in the pools.
- Per an incident report Sunday, the attacker managed to steal just under 220,000 LINK tokens, 4,507 ETH, 1.76 million USDT, 1.4 million USDC and 670,000 DAI.
- At current spot prices, this works out as a loss of just over $8 million.
- That's much more than the $630,000 and $350,000 hacks the protocol suffered in February, which both manipulated oracle price feeds in order to pay back bZx loans for far less than the actual amount.
- bZx paused the protocol in the aftermath of Sunday's attack so the bug could be patched, and resumed operations hours later.
- Kistner said the decision was taken in consultation with security experts, who had not instructed the company to shut down for any longer.
- He added the $8 million lost had already been debited by the protocol's insurance fund and will be paid out once the bZx community had ratified it.
- The bug managed to remain undetected in two extensive code audits from cybersecurity firms Certik and Peckshield.
- Kistner declined to comment on the identity of the hacker.
See also: DeFi Project dForce Refunds All Affected Users After $25M Hack
More For You
Pudgy Penguins is building a multi-vertical consumer IP platform — combining phygital products, games, NFTs and PENGU to monetize culture at scale.
What to know:
Pudgy Penguins is emerging as one of the strongest NFT-native brands of this cycle, shifting from speculative “digital luxury goods” into a multi-vertical consumer IP platform. Its strategy is to acquire users through mainstream channels first; toys, retail partnerships and viral media, then onboard them into Web3 through games, NFTs and the PENGU token.
The ecosystem now spans phygital products (> $13M retail sales and >1M units sold), games and experiences (Pudgy Party surpassed 500k downloads in two weeks), and a widely distributed token (airdropped to 6M+ wallets). While the market is currently pricing Pudgy at a premium relative to traditional IP peers, sustained success depends on execution across retail expansion, gaming adoption and deeper token utility.
More For You
Number of wallets with 1 million XRP is rising again
On-chain data points to underlying demand for XRP as ETFs pull in over $90 million.
What to know:
- XRP has fallen about 4 percent so far this month, even as on-chain data point to strengthening underlying investor interest.
- U.S.-listed spot XRP ETFs have attracted a net $91.72 million in inflows this month, bucking the trend of sustained outflows from bitcoin ETFs.
Top Stories
