BiFi BTC Collateral Exploit
Reported loss
$2.2M
Compromised deposit-address signing key
What happened
On July 8, 2022, an attacker used an exposed BiFi address-issuing server key to register a BTC deposit address they controlled. BiFi treated a transfer to that address as collateral and allowed the attacker to borrow 1,852 ETH. The team suspended native Bitcoin lending and announced that the BIFROST Foundation would cover the losses.
Technical root cause
An exposed address-issuing server key allowed attacker-controlled BTC addresses to be accepted as protocol deposit addresses.
How it happened
- The exposed server key let the attacker sign and register their own BTC deposit address.
- The attacker transferred 312 BTC to that address, which remained under their control.
- BiFi's relayer accepted the registered-address deposit and the system credited BTC collateral.
- The attacker borrowed 1,852 ETH against the falsely recognized deposit.
- The team rotated the exposed key and suspended BTC lending.
Protocol details
Classification
Infrastructure / Key Compromise
Protocol Type
Exploit/Other
Affected asset / contract
BFC
Protocol links
Website
@bifrostio
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
