The frontend of KyberSwap, a decentralized exchange built on top of Kyber Network, was recently exploited, resulting in a loss of $265k worth of user funds.
The team is trying to convince the hacker to return the funds and will ensure that the affected users are compensated.
In a Medium post, Kyber Network stated that a suspicious element was identified on KyberSwap fronted on 1 Sep, 3.24 PM GMT+7. The project immediately shut down the frontend and quickly identified the malicious code in their Google Tag Manager.
The malicious code inserted a false approval, allowing the hacker to extract the protocol’s funds to his address.
A few hours after the incident, the project team removed the script and announced that the UI was back up. They also made the suspected attacker’s addresses known and requested centralized exchanges to block potential funds transferred from the addresses.
Luckily, the amount of funds lost is less than 1% of the KyberSwap TVL, which is currently hovering in the $55M-$60M range. Only two whales’ addresses were affected.
Kyber Network announced that they’d be compensated and is willing to offer the hacker a 15% white hat bounty in exchange for returning the stolen funds. However, the hacker is yet to give a response.
Loi Luu, the Co-Founder of the protocol, stated that this was the first time the protocol was exploited in 5 years.
DeFi protocols were constantly a target for hackers in the last few years. According to Chainalysis, scammers were able to steal over $14 billion in cryptocurrencies in 2021.
On 2 Aug, Nomad Bridge lost nearly $200 million worth of crypto assets because of a smart contract vulnerability, this one being the fourth largest crypto hack in history.
