KyberSwap [1] [2] [3] [4] [5] [6] [7], a decentralized exchange (DEX) [2] [3] [6] [7], recently experienced a significant security breach resulting in a loss of $46 million. This breach has had a major impact on KyberSwap’s Total Value Locked (TVL) and the price of its native token, KNC [6].
Description
On November 22 [1] [3], KyberSwap fell victim to a highly sophisticated cyber attack, resulting in the loss of approximately $55 million in user funds [1] [2]. The attackers exploited KyberSwap’s Elastic smart contracts [1] [2] [3], executing complex swaps and transferring assets into their own wallets [2]. Despite the severity of the attack, KyberSwap managed to recover $5.7 million through negotiations with the hackers, successfully retrieving 90% of the user funds. To incentivize the return of the remaining assets [2], KyberSwap offered a 10% bounty to the attackers.
This attack specifically targeted KyberSwap’s implementation of concentrated liquidity [1] [3], demonstrating the advanced skill and specialized knowledge of the hackers. By exploiting a vulnerability in Kyber’s liquidity pools on Polygon and Avalanche, the hackers were able to double the liquidity before draining the pools.
In response, KyberSwap took immediate action to strengthen its defenses by implementing stringent security measures and conducting audits. They also collaborated closely with law enforcement and cybersecurity experts to track down the perpetrators and recover the remaining funds. Blockchain security firm PeckShield played a crucial role in the recovery efforts [4], helping to return around 361,876 USDCe to KyberSwap on the Avalanche blockchain [4]. Additionally, KyberSwap negotiated with front-run bot operators [4], resulting in the return of nearly $4.67 million to their digital wallet on the Polygon blockchain [4], with the operators keeping a 10% bounty [4].
This incident highlights the growing trend of cyber attacks on cryptocurrency exchanges and platforms, raising concerns about the security of decentralized finance platforms [2]. To address these concerns, KyberSwap has implemented internal smart contract checks, undergone audits by reputable security firms [2], and engaged community developers [2]. They have also encouraged further scrutiny through their bug bounty program [2].
KyberSwap is currently negotiating with the mastermind behind the hack, proposing a 10% bounty to match the stolen funds in exchange for the secure return of all assets [7]. The hack resulted in a loss of approximately $50 million and caused KyberSwap’s Total Value Locked to drop by 90% [7]. The DAO overseeing KyberSwap’s DEX is taking an unconventional approach by negotiating with the attacker and has set a deadline for the return of 90% of the stolen funds or face severe consequences [7]. KyberSwap is providing a private channel for resolution and actively investigating the incident to enhance security measures [7].
Conclusion
The security breach at KyberSwap has had significant impacts, including a loss of $46 million [6], a drop in Total Value Locked by 90%, and a decline in the price of KNC. KyberSwap is actively working to mitigate the effects of the breach by strengthening its security protocols and collaborating with experts in the field. This incident serves as a reminder of the importance of robust security measures in decentralized finance platforms.
References
[1] https://www.infosecurity-magazine.com/news/kyberswap-says-hackers-stole-55m/
[2] https://cybermaterial.com/kyberswap-reports-55m-crypto-theft/
[3] https://osintcorp.net/kyberswap-says-hackers-stole-55m-in-crypto/
[4] https://coinpedia.org/news/frontrun-bots-return-5-7m-stolen-crypto-back-to-kyberswap-deployers/
[5] https://www.coinspeaker.com/kyberswap-recovers-5-7m-hack-bounty/
[6] https://coinweb.com/news/kyberswap-loses-46m-in-defi-heist/
[7] https://coinpedia.org/news/kyberswap-attempts-to-recover-losses-offers-10-bounty-following-50-million-hack/
