Incident Overview
Atlantis Loans, a BSC-based lending protocol, was exploited, leading to a loss of 1,251,622 $USD.
Atlantis Loans is a Lending and Borrowing platform running on Binance Smart Chain. On June 10, 2023, Atlantis Loans, a DeFi lending protocol on the BNB chain, fell victim to a governance attack. The attacker exploited a vulnerability that allowed them to become the administrator of the token's proxy contract and manipulate its functions.
This was achieved through a malicious governance proposal created in the GovernorBravo contract on June 7, 2023, which set the admin of multiple ABep20Delegator contracts as malicious contracts. After a lockup period of 172,800 seconds, the malicious contract was set as a proxy contract admin for all tokens. This allowed the attacker to modify the ABep20Delegate implementation to include a backdoor, enabling the transfer of users' assets to their control.
The attacker currently controls approximately $1,161,848 worth of funds, while the rest stolen funds are at the attacker's initial address. Notably, a similar malicious proposal with ID 49 was submitted by the attacker on April 12, 2023, but it failed to pass the quorum.
Attacker Address:
https://bscscan.com/address/0xeade071f…2cf45b
Funds Holder Address:
https://bscscan.com/address/0xD8E91882…4D6f9f
Malicious Contract Address:
https://bscscan.com/address/0x027383c5…769094
Malicious Transaction:
https://bscscan.com/tx/0x3b0df86f…41d7e1
Funds Transfer Transaction:
https://bscscan.com/tx/0x71656b95…4b67bd
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Atlantis Loans, these are the critical security checks that could have prevented this incident (June 2023).
- Verify all logic paths related to Access Control Exploit / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- PeckShield Inc. Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Atlantis Loans
The Atlantis Loans hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.