The DeFi Protocol Ankr, which called itself the first “node-as-a-service” platform, had a security hole that allowed for the unfettered generation of its token, leading to a multi-million dollar scam.
Our analysis shows the $aBNBc token contract has an unlimited mint bug. Specifically, while mint() is protected with onlyMinter modifier, there is another function (w/ 0x3b3a5522 func. signature) that completely bypasses the caller verification to have arbitrary mint !!! https://t.co/h51e7xpcVf pic.twitter.com/caRgasNNHq
— PeckShield Inc. (@peckshield) December 2, 2022
PeckShield, a security research firm, claims that any user, without verification, can generate a limitless supply of reward-bearing staking tokens for the Ankr protocol from the contract’s code. Because of this, the adversary might generate six quadrillion aBNBc tokens.
After creating quadrillions of aBNBc tokens, the attacker traded 20 trillion of them for BNB and transferred the proceeds to Tornado Cash. The attacker then sold the BNB tokens for $5,000,000 in USDC.
The value of an aBNBc coin has dropped by around 99% since the hacker nearly depleted the liquidity pools on PancakeSwap and ApeSwap.
According to a tweet from Ankr, all staked assets within the protocol are secure at the moment.
Reportedly on-chain analytics firm Lookonchain, one smart trader turned 10 BNB ($2,885) into 15.5 million BUSD by taking advantage of the exploit. The trader did this by employing the DeFi lending protocol Helio, which did not have the most up-to-date pricing on aBNBc after the crash.
Using the pre-crash aBNBc pricing, the trader was also able to convert $16 million worth of the rarely traded HAY stablecoin into BUSD. Since then, the HAY stablecoin has lost a lot of its value, dropping to a low of 20 cents before recovering to its current price of 77 cents, as reported by CoinMarketCap.
The CEO of Binance, Changpeng Zhao, announced through Twitter that the three million dollars the hackers had given to his exchange had been frozen.
Leave this field empty if you're human:
