WEB3-FRONTEND-DNS-HIJACK-2022

On April 14, 2025 the perpetuals DEX KiloEx lost about $7.5 million across BNB Chain, Base, opBNB, and Taiko to what was reported as oracle price manipulation but was really an access-control failure. KiloEx's price feed (KiloPriceFeed.setPrices) was meant to be reachable only through a keeper-gated call chain, but the top-level MinimalForwarder.execute function was publicly callable and validated an attacker-supplied signature against attacker-supplied data, letting anyone forge a trusted call that reached setPrices and write an arbitrary price. The attacker set a market price far below true value, opened a leveraged position, then set the price far above value and closed it in the same flow, extracting fabricated profit from the vault; the sequence was repeated across all four chains, with a single transaction netting $3.12M. Reporting that framed it as flash-loan oracle manipulation was imprecise: no market liquidity was moved, the price was simply written directly through the unprotected forwarder. After KiloEx offered a 10% (~$750K) whitehat bounty and no legal action, the attacker returned essentially all of the funds by April 18, 2025.

On February 21, 2025, Bybit lost roughly $1.5 billion (about 401,347 ETH plus stETH/mETH) in the largest crypto hack to date. The root cause was a supply-chain/front-end compromise: a breached Safe{Wallet} developer machine let attackers inject malicious JavaScript into the Safe UI served from Safe's S3-backed app.safe.global front end. The code was scoped to activate only for Bybit's cold-wallet Safe (and one other contract), so when the three signers reviewed a routine cold-to-hot transfer the UI showed legitimate data while their Ledgers were sent a different payload. Signers blind-signed a delegatecall (operation=1) to an attacker contract that, executing in the proxy's storage context, overwrote storage slot 0 (the masterCopy/singleton pointer) with an attacker-controlled implementation, after which sweep functions drained the wallet. The FBI and TRM Labs attributed the theft to North Korea's Lazarus Group (TraderTraitor/APT38); funds were rapidly laundered and not recovered.

On October 16, 2024, the cross-chain lending protocol Radiant Capital lost roughly $50M (about $53M across Arbitrum and BSC) after attackers compromised the devices of at least three of its multisig signers. Initial access began September 11, 2024 via a Telegram message spoofing a trusted former contractor, delivering a ZIP with a decoy PDF that was actually a macOS application carrying INLETDRIFT backdoor malware. The malware sat between the signers' browsers and their hardware wallets, so the Safe (Gnosis) UI and Tenderly simulations displayed correct data while the signers blind-signed a malicious transferOwnership() call on the LendingPoolAddressesProvider contract; the 3-of-11 threshold was met and the attacker then upgraded the pools to a malicious implementation and drained them. Mandiant assessed with high confidence the attack was conducted by North Korea-linked UNC4736 (aka Citrine Sleet/AppleJeus), part of the Lazarus cluster. Funds were not recovered and the protocol later wound down.

On July 18, 2024 Indian exchange WazirX lost approximately $230M (about $234.9M) from a Safe (Gnosis) 4-of-6 multisig wallet held under a custody arrangement with Liminal (five WazirX keys plus one Liminal key). The attack was a blind-signing exploit: signers reviewed benign transaction details in the manipulated Liminal interface while the payload actually signed differed, authorizing a delegatecall (function selector 0x804e1f0a) that overwrote slot0 of the Safe proxy and repointed its implementation to an attacker-controlled contract (0xef279c2ab14960aa319008cbea384b9f8ac35fc6). Once the proxy pointed to attacker logic the wallet was fully controlled without further keys, and it was drained. The theft was attributed to North Korea's Lazarus Group, later confirmed in a joint statement by the US, South Korea and Japan in January 2025. Funds were laundered via Tornado Cash; victims are being repaid through a court-approved restructuring (resumed October 2025, BitGo custody) rather than direct recovery.

On June 10, 2024, UwU Lend, an Aave-fork lending protocol on Ethereum, lost about $19.3 million, followed by a second ~$3.7 million drain on June 13, 2024 (combined ~$23 million). The root cause was flash-loan oracle manipulation of the sUSDe price feed: the custom sUSDePriceProviderBUniCatch oracle priced sUSDe as the median of 11 sources, 5 of which read instantaneous Curve pool spot prices via get_p (no TWAP/EMA smoothing) across the FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD and GHOUSDe pools. Using a roughly $3.8 billion flash loan, the attacker swapped large USDe amounts to suppress the median sUSDe price, set up positions, then reversed the swaps to inflate it, rendering their own leveraged position liquidatable and self-liquidating repeatedly to harvest base assets at favorable rates. Curve explicitly advises against using get_p spot reads for oracles. The June 13 follow-up reused collateral left from the first attack, since sUSDe was not disabled as borrowable collateral.

On December 31, 2023 (reported January 1, 2024), the Orbit Chain cross-chain bridge lost about $81.5 million when the attacker gained signing control over a majority of validators (analysts cite 7 of 10) and authorized withdrawals from the Ethereum-side vault, draining roughly 30M USDT, 10M USDC, 10M DAI, about 9,500 ETH and 231 WBTC across five transactions to fresh wallets, plus a further transaction disabling the bridge. The root cause was validator private-key/credential compromise enabling improper authorization, not a smart-contract logic flaw; the attack wallet was funded via Tornado Cash. A later statement from developer Ozys alleged that a departing security lead had arbitrarily weakened the firewall policy in November 2023 before leaving without handover, which Ozys treats as the leading access hypothesis, though the causal link remains unproven. The methodical transaction pattern led analysts and South Korean authorities to suspect North Korea's Lazarus Group, but attribution was not formally confirmed. Funds were later laundered via Tornado Cash and not recovered.