The decentralized trade KyberSwap has supplied a ten% bounty reward to the hacker who stole $46 million on Nov. 22 and left a observe of negotiation. The trade needs 90% of the loot returned by 6 am UTC on Nov. 25.
On Nov. 23, KyberSwap alerted customers that its liquidity resolution, KyberSwap Elastic, was compromised and suggested them to withdraw funds. In the meantime, on Nov. 22, the hacker made away with roughly $20 million in Wrapped Ether (wETH), $7 million in wrapped Lido-staked Ether (wstETH) and $4 million in Arbitrum (ARB) tokens. The hacker then siphoned the loot throughout a number of chains, together with Arbitrum, Optimism, Ethereum, Polygon and Base.
After hiding the stolen funds, the hacker wrote an on-chain message directed to KyberSwap builders, workers, decentralized autonomous group members and liquidity suppliers, stating, “Negotiations will start in a few hours when I am fully rested.”
Following a day’s silence from each ends, KyberSwap responded to the hacker requesting the return of 90% of the stolen funds. The staff acknowledged the talents of the hacker and laid down a proposal:
“On the table is a bounty equivalent to 10% of users’ funds taken from them by your hack, for the safe return of all of the users’ funds. But we both know how this works, so lets cut to the chase so you and these users can all get on with life.”
If the hacker fails to pay again or reply to KyberSwap by 6 am UTC, Nov. 25, “you stay on the run,” stated KyberSwap. The staff is open to additional dialogue with the hacker through electronic mail.
Related: KyberSwap announces potential vulnerability, tells LPs to withdraw ASAP
A dissection of the latest KyberSwap hack by a decentralized finance (DeFi) knowledgeable means that the attacker used an “infinite money glitch” to empty funds.
Ambient trade founder Doug Colkitt defined the KyberSwap attacker relied on a “complex and carefully engineered smart contract exploit” to hold out the assault.
1/ Finished a preliminary deep dive into the Kyber exploit, and assume I now have a reasonably good understanding of what occurred.
This is well essentially the most complicated and punctiliously engineered sensible contract exploit I’ve ever seen…
— Doug Colkitt (@0xdoug) November 23, 2023
The attacker then repeated this exploit towards different Kyberswap swimming pools on a number of networks, ultimately getting away with $46 million in crypto loot.
Magazine: This is your brain on crypto: Substance abuse grows among crypto traders
