Kyber Network lost $54.7M when its Elastic pool logic gave attackers precision control over price boundaries. CoinSpot lost $2.5M to compromised hot wallets. TheStandard.io was drained via a low-liquidity PAXG pool, and TrustPad’s staking contract handed out rewards without checking senders. Different vectors, same flaw: missing checks where they matter most.
On November 23rd, the Kyber Network exploit on the Ethereum Mainnet resulted in a $123M loss due to KyberSwap’s liquidity calculation error. KyberSwap utilizes an Elastic model that optimizes liquidity allocation by setting custom price boundaries. The attacker exploited the boundary logic within these pricing ranges to generate a profit. The attacker initiated the exploit by borrowing 2,000 WETH in flash loans from AAVE and subsequently adding liquidity to frxETH and WETH pools. This additional liquidity provided the attacker with the means to adjust the pricing boundaries, allowing for manipulation of the exchange rate. Kyber Network confirmed the exploit and promptly paused the Elastic pools in response.
Exploit Contract: 0xfd7b111aa83b9b6f547e617c7601efd997f64703
Transaction Hash: 0x485e08dc2b6a4b3aeadcb89c3d18a37666dc7d9424961a2091d6b3696792f0f3
On November 8th, the CoinSpot exploit on the Ethereum Mainnet resulted in a $2.5M loss due to the compromise of private keys. The attacker drained 1,262 ETH and 21 ETH from two how wallets. The attacker then swapped the stolen funds to BTC and WBTC through THORChain and transferred them to Wan Bridge. The CoinSpot has not officially acknowledged the exploit.
Exploit Contract: 0xE4b3dD9839ed1780351Dc5412925cf05F07A1939
Transaction Hash: 0x210ca8b12d1763307636982a0972437009ec7f65626db23c8b2b2a0a308bcf61
On November 7th, theStandard.io exploit on the Arbitrum chain resulted in a $290K loss. The root cause of the hack was the low PAXG liquidity in the PAX Gold pool. By providing 19 WBTC as collateral into this pool, the attacker gained control over the pool liquidity, enabling manipulation of the exchange pricing. Subsequently, the attacker borrowed an artificially inflated amount of stable Euro coins. The theStandard.io team acknowledged the exploit, disabled transactions on V2 pools, and announced a bounty for the safe return of the funds.
Exploit Contract (on Arbitrum chain): 0xfEb4DfC8C4Cf7Ed305bb08065D08eC6ee6728429
Transaction Hash: 0x51293c1155a1d33d8fc9389721362044c3a67e0ac732b3a6ec7661d47b03df9f
On November 6th, the TrustPad exploit on the BNB chain resulted in a $155K loss due to a logic vulnerability. The issue was within the receiveUpPool() function in the LaunchpadLockableStaking contract, which failed to verify the msg.sender, allowing arbitrary external calls to manipulate the newlockstartTime variable. This vulnerability enabled the attacker to collect TAPD rewards without waiting for the lock time, resulting in a profit.
Exploit Contract (on BNB chain): 0x129f4ac88b0446f9b46b176c93531e6cf4687657
Transaction Hash: 0x191a34e6c0780c3d1ab5c9bc04948e231d742b7d88e0e4f85568d57fcdc03182