- A personal key compromise allowed the attacker to switch unauthorized tokens.
- OKX admitted to the exploit and stated it will compensate victims.
Crypto funds price greater than $400,000 have been stolen from OKX DEX, a decentralized trade aggregator platform, in line with blockchain safety agency SlowMist.
Decoding the modus operandi
The exploit was ascribed to a compromise of the administration rights of a market maker contract, permitting the attacker to switch tokens not licensed by the customers.
OKX DEX, an providing by well-liked centralized trade OKX [OKB], combines the completely different buying and selling costs via all built-in third-party DEXes and recommends the perfect buying and selling worth to customers.
When customers wish to ship tokens, they have to approve a TokenApprove contract, which permits the funds to be claimed by the receiver. After this, the claimTokens operate of the contract is triggered, which completes the switch.
Nevertheless, within the late hours of the twelfth of December, a supervisor of the contract mischievously altered the performance. This was most certainly brought on by the leak of the account’s personal keys.
In response to SlowMist, the brand new implementation surpassed the authorizing half, enabling the attacker to immediately execute the claimTokens operate. Because of this, the attacker was capable of empty customers’ wallets of 1000’s of {dollars}.
SlowMist flagged the handle of the suspected attacker together with the handle the place the hack proceeds have been going to.
OKX will compensate customers
Responding to the claims, OKX admitted to the exploit and linked it with an deserted DEX contract which was now not in use. Nevertheless, it stated that the affected contracts have been deactivated.
The DEX estimated the hacked quantity to be round $370,000 and guaranteed affected customers of compensation. As for the remainder of the person belongings, the trade stated that they have been secure.
OKX said that it will undertake a safety test on deserted good contracts to keep away from such issues sooner or later.
The event reiterated safety dangers related to decentralized finance (DeFi) transactions and the necessity for elevated monitoring.
The exploit didn’t appear to materially hurt OKX’s native asset, OKB. The trade token recorded 24-hour beneficial properties of two.9%, AMBCrypto noticed utilizing CoinMarketCap’s knowledge.
