Boy X Highspeed Hack

Boy X Highspeed exploit happened using privileged access, 1865 $ETH was stolen and transferred using Tornado Cash

Boy X Highspeed's staking pool contract on the Binance and the AVAX chain was exploited for the total amount of various assets worth 2,584,890 $USD. All funds were withdrawn from the staking contract using the privileged function inCaseTokensGetStuck(). Consequently, the stolen funds on both chains were bridged to the Ethereum chain and transferred using Tornado Cash.

Attacker's privileged address:

https://bscscan.com/address/0xafc6e88c…2f7be3

Attacker's address used for transfer assets:

https://bscscan.com/address/0x158f5cb7…8ce345

https://etherscan.io/address/0x158f5cb7…8ce345

BXH Staking contract:

https://bscscan.com/address/0xcc47dac5…c3a474

Withdraw transaction:

https://bscscan.com/tx/0x632fc37c…56d871

Tornado Cash transfers:

https://etherscan.io/tx/0x11d407d9…eb035b