What happened
On July 9, 2018, an attacker gained control of a Bancor wallet authorized to upgrade smart contracts. The attacker moved approximately $23.5 million in ETH, NPXS, and BNT. Bancor froze roughly $10 million in BNT using its disclosed Anti-Theft Override, while the ETH and NPXS could not be frozen.
Public reporting did not establish how the upgrade-authority wallet was compromised.
Case & protocol details
Attack Timeline
The incident centered on privileged operational authority, not a permissionless contract-logic exploit. A wallet with authority to upgrade certain Bancor contracts was compromised, allowing the attacker to move about 24,984 ETH, 229 million NPXS, and 3.2 million BNT. Bancor used its BNT freeze capability before that token could be liquidated, but it did not control the stolen ETH or NPXS.
The gross assets moved and the amount ultimately unrecovered are different figures, so the $23.5 million gross-transfer estimate should not be presented as wholly recovered or wholly unrecovered.
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.