Boy X Highspeed Hack
What happened
On 30 October 2021 an attacker drained about $139 million in tokens from the BNB Smart Chain deployment of BXH, a DEX that started on HECO. BXH first put the loss at about $130 million and later raised it to $139 million. Security partner PeckShield attributed the theft to a single leaked admin key, and BXH CEO Neo Wang said the attacker had either hacked a staff computer, planted malware that an administrator triggered, or was an insider.
BXH said its HECO and OEC deployments were not affected but locked those contracts as a precaution, halted withdrawals, reported the case to Chinese cyber police, and offered the attacker a whitehat reward for returning the funds plus a $1 million bounty for help recovering them. The funds were not returned. In June 2024 the attacker moved 9,491 ETH (about $31 million at the time) through Tornado Cash, according to on-chain analyst Ember.
How it happened
- The attacker obtained the private key of a BXH administrator account on BNB Smart Chain. How the key leaked has not been published.
- That admin account alone could move funds held by BXH's BSC contracts, so no second signer or timelock stood in the way.
- The attacker used the key to sign transactions sending about $139 million in tokens from BXH's BSC pools to an address they controlled.
- BXH's native token dropped from about $0.083 to about $0.045 over the next two days.
- The stolen funds stayed with the attacker. In June 2024 they gathered 9,491 ETH across three addresses and laundered it through Tornado Cash.
Protocol details
Evidence
- report Report beincrypto.com
- report Report coindesk.com
- analysis DeFiLlama defillama.com
- analysis BXH says its exploit, now estimated at $139M, came from admin key leakage forkast.news
- analysis $139M BXH Exchange Hack Was the Result of Leaked Admin Key coindesk.com
- analysis Another DeFi platform, BXH, suffers $130M exploit forkast.news
- analysis Explained: The BXH Exchange Hack (October 2021) halborn.com
- analysis BXH hacker who stole more than $130 million in 2021 transferred 9491 ETH via Tornado Cash 5 hours ago coinlive.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
