A $2.7 Million Exploit Hits OKX’s DEX Aggregator
A decentralized exchange (DEX) aggregator from OKX has reportedly fallen victim to a $2.7 million exploit, according to security analysts. The attack is believed to have occurred due to a leak of the DEX’s admin private key. Security firm SlowMist posted about the incident on X and shortly after, OKX confirmed that a deprecated smart contract on their DEX had been compromised. They assured affected users that they are working to secure funds and will reimburse those impacted.
PeckShield, a security analysis firm, later confirmed the exploit, estimating that around $2.7 million worth of crypto assets were stolen. Arkham, a blockchain data analytics provider, also verified the attack and suggested that the hacker may be connected to other exploits in the industry. They offered a bounty for information leading to the identification of the attacker or the return of funds.
What Led to the Attack?
According to SlowMist, users authorize token exchanges on the DEX through the TokenApprove contract. The DEX contract then transfers these tokens using TokenApprove’s functionality. The Proxy Admin manages an essential component called the DEX Proxy. The Proxy Admin Owner has the power to upgrade this contract, granting it access to call the claimTokens function of the TokenApprove contract for token transfers.
SlowMist suggests that this attack may have occurred due to a leaked private key of the Proxy Admin Owner. They note that an upgrade was implemented by the current owner on December 12th at 22:23 UTC, which modified the functionality of the DEX Proxy contract. This change allowed direct calls to be made to the claimTokens function of the DEX contract for token transfers, creating a vulnerability exploited by attackers.
OKX DEX did not respond to The Block’s request for comment.
Hot Take: OKX’s DEX Aggregator Falls Victim to $2.7 Million Exploit
A decentralized exchange aggregator operated by OKX has suffered a significant exploit, resulting in the theft of approximately $2.7 million worth of crypto assets. The attack is believed to have been made possible due to a leak of the DEX’s admin private key. Security analysts have confirmed the exploit and linked it to other similar attacks in the industry. OKX has taken immediate action to secure user funds and has promised to reimburse those affected by the incident. This event highlights the ongoing security challenges faced by decentralized exchanges and the importance of implementing robust measures to protect user funds.
By
By
By
By
By