Incident Overview
BTC20Token, a project running on the Ethereum blockchain, was exploited on August 19, 2023, through a flash loan attack. The attacker successfully stole 18.34 ETH, equivalent to approximately 30,478 $USD.
On August 19, 2023, BTC20Token, a "green version" of Bitcoin, that provides staking opportunities, was targeted by an attacker who leveraged a flash loan attack to exploit vulnerabilities within the project's smart contracts. As of August 22, 2023, the stolen funds remained at the attacker's original address.
The value of the stolen assets, 18.34 ETH, was approximately 30,478 $USD.
Attacker's Address:
https://etherscan.io/address/0x6CE9fa08…34C9F6
Malicious Transaction:
https://etherscan.io/tx/0xcdd93e37…0b2dbe
Malicious Contract:
https://etherscan.io/address/0xb7FbF984…F24f33
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to BTC20Token, these are the critical security checks that could have prevented this incident (August 2023).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next BTC20Token
The BTC20Token hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.