Another month, another key compromise — this time CoinEx ($54M) and Huobi ($8M) both got drained through hot wallet access. BFCToken burned itself into a manipulated price. FloorDAO’s Olympus fork forgot where to send funds. These weren’t edge-case bugs; they were basic failures across ops, accounting, and function routing. Total losses: over $60M.
On September 24th, the Huobi Global exploit on the Ethereum Mainnet resulted in a $8 million loss due to the compromise of private keys. The attacker executed the attack in a single transaction by sending 4,999 ETH to a malicious contract. The attacker then created a second malicious contract and transferred 1,001 ETH to this new contract. Huobi has since confirmed that they have identified the attacker and has extended an offer of a 5% white hat bounty reward if the funds are returned to the exchange.
Exploit Contract: 0x2abc22eb9a09ebbe7b41737ccde147f586efeb6a
Transaction Hash: 0xe9eefff04322a1e9262aad139e7b03954709a7c2ffea5ba9d1026a24fb58c029
On September 12th, the CoinEx exploit on multiple chains resulted in a $54M loss. The root cause of this exploit was the compromise of private keys. The attacker drained funds in various tokens, including 11M ETH, 204K BKK, 137M TRX, 29K BNB, and many more across multiple chains including BSC, Arbitrum, and Optimism. The CoinEx team acknowledged the exploit and temporarily suspended all transactions. The team confirmed that all affected users would be fully reimbursed.
Exploit Contract: 0x33Ddd548FE3a082d753E5fE721a26E1Ab43e3598
Transaction Hash: 0xb6a07c2c591e43abc63add833aaf4d6ab47e66f05cf6b49a9dda7c2317b2d61c
On September 10th, the BFCToken exploit on the BNB chain resulted in a $38K loss due to a price manipulation vulnerability. The root cause was a vulnerability in the private _transfer() function within the BFCToken contract. This function burned BFC tokens whenever triggered. The attacker exploited this by burning tokens, artificially reducing the total supply, and inflating the token price. The attacker then sold the BFC tokens for profit and converted the funds into ETH on PancakeSwap.
Exploit Contract (on BNB Chain): 0x595eac4A0CE9b7175a99094680fbe55A774B5464
Transaction Hash: 0x8ee76291c1b46d267431d2a528fa7f3ea7035629500bba4f87a69b88fcaf6e23
On September 5th, the FloorDAO exploit on the Ethereum Mainnet resulted in $16K due to a logic vulnerability. The root cause was a vulnerability in the stake() function within the FloorDAO contract which is forked from Olympus DAO. Instead of sending the funds to the intended warmupContract, the stake() function mistakenly sent the funds to the caller. The attacker was able to exploit this logic vulnerability by calling the stake() and unstake() functions multiple times within the same transaction, making a profit.
Exploit Contract: 0x759c6De5bcA9ADE8A1a2719a31553c4B7DE02539
Transaction Hash: 0x1274b32d4dfacd2703ad032e8bd669a83f012dde9d27ed92e4e7da0387adafe4