BTC24H Hack

Reported loss $86K
Polygon
Acces Control Exploit

What happened

BTC24H, an ERC-20 token launched on Polygon in December 2024, lost about $85,700 on December 16, 2024. The project's Lock contract had a claim function that did not check whether msg.sender was entitled to the locked tokens. Once the unlock date passed, anyone could claim. The attacker claimed 110,000 BTC24H and sold them into the token's Uniswap v3 pools for WBTC and USDT in the same transaction. The project had no visible website or social accounts, and no response has been found.

Attacker: 0xde0a99fb39e78efd3529e31d78434f7645601163

Attack contract: 0x3cb2452c615007b9ef94d5814765eb48b71ae520

Exploit transaction: 0x554c9e4067e3bc0201ba06fc2cfeeacd178d7dd9c69f9b211bc661bb11296fde

How it happened

  1. After the Lock contract's unlock date, the attacker's EOA called its attack contract.
  2. The attack contract claimed tokens from the Lock contract, which never checked whether the caller was an eligible claimant. 110,000 BTC24H were transferred to the attack contract.
  3. The contract swapped 100,000 BTC24H in the WBTC/BTC24H Uniswap v3 pool and 10,000 BTC24H in the USDT/BTC24H pool.
  4. About 0.764 WBTC and 4,953 USDT went to the attacker's EOA, together roughly $85,700 at the time.

Protocol details

Classification Protocol Logic / Token / Access Control
Protocol Type Exploit/Access control
Affected asset / contract BTC24H

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes