Incident Overview
Ankr protocol was exploited by private key compromisation. The attacker replaced contract implementation and was able to mint aBNBc tokens infinitely.
Ankr is a decentralized infrastructure with a rich ecosystem. The staking contract of the protocol on the Binance Smart Chain was exploited using access control vulnerability. The attacker replaced the implementation for the staking proxy with an unverified malicious contract. Consequently, the malicious contract was used to mint 10,000,000,000,000 $aBNBc which were exchanged for 5,500 $BNB and 5,340,000 $USDC. $aBNBc token price dropped nearly 99% and almost all the liquidity was drained from PancakeSwap and ApeSwap pools. The stolen amount almost completely was transferred through TornadoCash, AnySwap, and CelerBridge. There is just 100 $BNB left in the attacker's original address at the moment.
At this moment proxy implementation was replaced with the new unverified one.
Attacker address:
https://bscscan.com/address/0xf3a465C9…05c777
Malicious transaction:
https://bscscan.com/tx/0x61e0f3f0…506812
https://bscscan.com/tx/0xcbc5ff4a…3e282b
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Ankr, these are the critical security checks that could have prevented this incident (December 2022).
- Verify all logic paths related to Access Control Exploit / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Post-Incident Timeline
-
2023-03-03
Gained $aBNBc was used as collateral on Helio Protocol, allowing two exploits with a funds loss of 15,500,000 $USD and 3,500,000 $USD respectively. The protocol's stablecoin $HAY lost its dollar peg and the token price dropped 0.62 $USD at the moment of the incident. After some period of time, $HAY token's peg was recovered.
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Ankr
The Ankr hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.