AI Protocol Hack

Reported loss $4.3M
Phishing

What happened

On March 1, 2024, a wallet-drainer phishing operation stole about 113.1 million ALI and about 161,597 PUSH from one ALI holder, worth roughly $4.3-4.4 million. The victim had signed a malicious Uniswap Permit2 PermitBatch message. The drainer used that signature in a single transaction (0xc943ea893065cc7deac1a42d1670da1a9ebeb9fc1807bf3d835224dd499417cc) to move the tokens from 0x7653C9364bB800E1136aa0634c4629eBe76A744E to three phishing-labelled addresses, including 0x2ee9a1751b6c8034961cb192bf3a8b9110621edb.

Scam Sniffer flagged the theft, and ZachXBT coordinated with the AI Protocol team on an emergency community vote to burn roughly 110 million of the stolen ALI before the attacker could sell it. The burn stopped the attacker from profiting on those tokens, but it did not return anything to the victim.

How it happened

  1. The victim signed an off-chain Uniswap Permit2 PermitBatch message that granted a phishing-controlled spender access to the wallet's ALI and PUSH.
  2. At 02:07 UTC on March 1, 2024, a phishing-labelled address submitted the signed permits and transfers in one batched execTransaction call (tx 0xc943ea89...17cc).
  3. Permit2 recorded the approvals, and about 113.1M ALI and 161,597 PUSH moved from the victim to three phishing-labelled addresses.
  4. ZachXBT coordinated with the AI Protocol team, and the community voted to burn about 110 million of the stolen ALI, so the attacker could not cash them out.

Protocol details

Classification Other / Token
Protocol Type Exploit/Phishing
Affected asset / contract ALI

Evidence

Understand the attack patterns

Compare incidents →
Phishing Attacks

Same attack technique

Browse all hacks →
Phishing $91.0M lost Phishing $55.0M lost BEAM $5.2M lost Massive Phishing Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes