Ankr Hack

Reported loss $5.0M
BNB Chain
Malicious proxy implementation upgrade followed by unrestricted aBNBc minting and DEX liquidity drainage

What happened

Ankr's aBNBc liquid-staking token on BNB Chain was compromised in early December 2022 after an attacker gained control of the privileged deployer key. The attacker upgraded the token proxy to a malicious implementation, minted enormous quantities of aBNBc, and sold them into DEX pools for about $5 million in BNB and stablecoin liquidity. This page covers Ankr only: the later Helio bad-debt exploit was a separate oracle failure triggered by aBNBc's collapsed market price.

Technical root cause

A single deployer private key held immediate upgrade authority over a high-value token proxy. Once the key was compromised, the attacker could install an implementation whose added mint entry point omitted caller authorization. The incident was an upgrade-admin and key-management failure, not a flaw in normal aBNBc economic logic.

How it happened

A compromised Ankr deployer account invoked ProxyAdmin.upgrade for the aBNBc proxy, replacing its implementation with attacker-controlled code. The replacement exposed a selector that bypassed the normal mint authorization check. The attacker used that function repeatedly to mint unbacked aBNBc, then sold the artificial supply through BNB Chain DEX liquidity.

The nominal minted token amount was far larger than the realized loss because DEX liquidity capped what could be extracted. Ankr secured the contracts, paused relevant collateral movement, retired the affected token products, and compensated eligible pre-exploit holders and liquidity providers. That compensation is not represented as stolen-fund recovery.

Protocol details

Classification Compromised Upgrade Authority / Privileged-Key Compromise
Protocol Type Liquid Staking
Affected asset / contract ANKR
Implementation language Solidity
Protocol links Website @ankr
Attacker Address 0xf3a465C9fA6663fF50794C698F600Faa4b05c777
Exploit Transaction 0xcbc5ff4a6c9a66274f…09ca3e282b

Security review history

Post-Incident Timeline

  • 2023-03-03

    Gained $aBNBc was used as collateral on Helio Protocol, allowing two exploits with a funds loss of 15,500,000 $USD and 3,500,000 $USD respectively. The protocol's stablecoin $HAY lost its dollar peg and the token price dropped 0.62 $USD at the moment of the incident. After some period of time, $HAY token's peg was recovered.

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes