ApolloX Hack

Reported loss $2.2M
BNB Chain
Other

What happened

On June 8, 2022, an attacker exploited ApolloX's trading-reward signature flow to withdraw about 53 million APX from the withdrawal contract. CertiK reported that the APX was swapped through PancakeSwap and that the attacker earned about 2.1 million BUSD.

How it happened

  1. A flaw in the trading-rewards flow allowed the attacker to accumulate signatures.
  2. Multiple contracts repeatedly called claim() in ApolloxExchangeTreasury, which accepted the signatures and transferred APX.
  3. The attacker swapped the APX for BUSD on PancakeSwap and later moved the assets through a ZAP bridge.

Protocol details

Classification Exchange (DEX) / Input Validation
Protocol Type Exploit/Other
Affected asset / contract APX
Implementation language Solidity
Protocol links Website @ApolloX_com

Evidence

Same attack technique

Browse all hacks →
Cardano Wanchain $10.0M lost Arbitrum Lumi Finance $270K lost Ethereum Multichain $147K lost Optimism Quixotic $200K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes