What happened
On April 22, 2025, BTCMapp contracts on Arbitrum were exploited through a logical vulnerability, resulting in ongoing losses exceeding $1 million.
The attackers targeted a flaw in the overPaper function of the BTCMapp smart contract, which lacked proper checks and allowed them to withdraw approximately half of the contract’s balance in repeated calls. The exploit was initiated by a wallet that performed several malicious transactions, systematically draining assets. Following the theft, the attacker began laundering the funds by bridging them to Ethereum using intermediary addresses.
The exploit is still in progress, with stolen funds actively moving across chains, prompting investigators and the community to monitor and attempt containment.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
