OKX’s $2.7M exploit came from a familiar vector: private key compromise post-contract upgrade. Time Token burned supply without sender validation, letting attackers pump price and dump. FCN-TRUST skipped swap authorization and got flash-loaned for $504K. Thunder Terminal? A third-party vendor slip cost $192K. When access and inputs aren’t locked, exploits don’t need to be sophisticated — they just need to be timely.
On December 27th, the Thunder Terminal on the Ethereum Mainnet resulted in a $192K loss. Despite the exploiter’s claim that the private keys were compromised, the Thunder Terminal team reported that the actual root cause of the hack was a compromise of a third-party service. The exploiter drained funds from a total of 114 wallets. Thunder Terminal team temporarily suspended all transactions.
Exploit Contract: 0xd07eb4e7a4fdfecb4e4553b4896df199f4797e2b
Transaction Hash: 0x17703c113f6047745165faaecfff1d4ffb9ded548aa425def53c60bd1b3b885b
On December 12th, the OKX exploit on the Ethereum Mainner resulted in a $2.7M loss. The root cause of the exploit was a compromise of the Proxy Admin Owner’s private key, which occurred after the DEX Proxy contract upgrade. Following the upgrade, the DEX Proxy contract allowed direct calls to the claimTokens() function, allowing unauthorized token transfers. The OKX team acknowledged the incident and removed the DEX Proxy contract from the trusted list.
Exploit Contract: 0x40aa958dd87fc8305b97f2ba922cddca374bcd7f
Transaction Hash: 0xeae5d29f426306270aaa071c52debbacfa2ba2b0150cbeefa103285044447896
On December 6th, the Time Token exploit on the Ethereum Mainnet resulted in a $190K loss. The root cause was the absence of the req.from parameter in the multicall() function within the TokenERC20 contract, allowing the function to be called from any arbitrary address. Exploiting this vulnerability, the attacker invoked the function to burn Time Tokens, artificially reducing the total supply and inflating the token price. Subsequently, the attacker profited by selling the Time tokens.
Exploit Contract: 0xc82bbe41f2cf04e3a8efa18f7032bdd7f6d98a81
Transaction Hash: 0xecdd111a60debfadc6533de30fb7f55dc5ceed01dfadd30e4a7ebdb416d2f6b6
On December 2nd, the FCN-TRUST exploit on the BNB chain caused a loss of $504K. The attacker initially borrowed 513K BSC-USD and manipulated the price of FCN-TRUST tokens by performing large swaps on Pancake Swap V2. These swaps increased the FCN-TRUST token price artificially, allowing the attacker to make a profit after repaying the flash loan. The lack of limits and authorization on FCN-TRUST and BSC-USD swaps enabled the attacker to execute multiple large swaps.
Exploit Contract (on BNB Chain): 0x0fea057db0e6b45fa1a0065cd512150987f2af08
Transaction Hash: 0xbeea4ff215b15870e22ed0e4d36ccd595974ffd55c3d75dad2230196cc379a52