Boy X Highspeed Hack

Reported loss $2.6M
Other

What happened

In September 2022, Boy X Highspeed (BXH) staking pools on BNB Chain, Avalanche, and HECO were drained through a privileged emergency-withdrawal path. Halborn reports that the attacker invoked the public inCaseTokensGetStuck function, transferred pool-held assets to an attacker-controlled address, moved the stolen assets to Ethereum, and then used Tornado Cash. Loss estimates vary: Halborn cites approximately 1,865 ETH or $2.43 million, while another cited estimate was $12.5 million.

How it happened

  1. The attacker obtained access to the privileged emergency-withdrawal path in the BXH staking-pool contracts.
  2. They invoked inCaseTokensGetStuck on pools deployed on BNB Chain, Avalanche, and HECO.
  3. The function transferred assets held by the pools to a specified attacker address.
  4. The stolen assets were moved to Ethereum and laundered through Tornado Cash.

Protocol details

Classification Yield Aggregator
Protocol Type Exploit/Other

Evidence

Same attack technique

Browse all hacks →
Journey of Awakening $127K lost Rabby Wallet $194K lost Omni Bridge $272K lost DarkPool $104K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes