BTCM App Hack

On April 22, 2025, BTCMapp contracts on Arbitrum were exploited through a logical vulnerability, resulting in ongoing losses exceeding $1 million.

The attackers targeted a flaw in the overPaper function of the BTCMapp smart contract, which lacked proper checks and allowed them to withdraw approximately half of the contract’s balance in repeated calls. The exploit was initiated by a wallet that performed several malicious transactions, systematically draining assets. Following the theft, the attacker began laundering the funds by bridging them to Ethereum using intermediary addresses.

The exploit is still in progress, with stolen funds actively moving across chains, prompting investigators and the community to monitor and attempt containment.

Exploit tx

https://arbiscan.io/tx/0xc0ef2292…177c0b

Attacker

https://arbiscan.io/address/0xbf4fe9c8…495b16