What happened
Arbitrum (ARBX) contract exploited due to onlyOwner function, leading to the minting and dumping of 10M ARBX tokens.
The ARBX contract contained a mint() function with onlyOwner, which was exploited to mint 10M ARBX tokens to 8 different addresses. Approximately 4.5M ARBX were minted in a single transaction and subsequently dumped by the recipient. The users' assets were drained from several pools, with the stolen funds being bridged to Ethereum.
The addresses involved in the exploit:
The transaction of 4.5M ARBX minting:
The transaction of asset draining:
The Ethereum address where stolen funds were bridged:
Protocol details
Evidence
- report Post-mortem rekt.news
- report @certikorg incident report twitter.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
