Bancor Hack

Reported loss $23.5M
Ethereum
Unauthorized use of contract-upgrade authority

What happened

On July 9, 2018, an attacker gained control of a Bancor wallet authorized to upgrade smart contracts. The attacker moved approximately $23.5 million in ETH, NPXS, and BNT. Bancor froze roughly $10 million in BNT using its disclosed Anti-Theft Override, while the ETH and NPXS could not be frozen.

Public reporting did not establish how the upgrade-authority wallet was compromised.

How it happened

The incident centered on privileged operational authority, not a permissionless contract-logic exploit. A wallet with authority to upgrade certain Bancor contracts was compromised, allowing the attacker to move about 24,984 ETH, 229 million NPXS, and 3.2 million BNT. Bancor used its BNT freeze capability before that token could be liquidated, but it did not control the stolen ETH or NPXS.

The gross assets moved and the amount ultimately unrecovered are different figures, so the $23.5 million gross-transfer estimate should not be presented as wholly recovered or wholly unrecovered.

Protocol details

Classification Privileged upgrade-wallet compromise
Protocol Type Exploit/Other
Affected asset / contract BNT
Implementation language Solidity
Protocol links Website @Bancor

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes