What happened
bZx suffered an approximately $8.1 million iToken balance-duplication exploit in September 2020. Self-transfers increased token balances without a corresponding deposit. The Block later reported that co-founder Kyle Kistner confirmed the attacker had returned the stolen funds.
Technical root cause
Self-transfers increased iToken balances because the transfer logic failed to apply the matching debit.
How it happened
- A holder obtained iTokens representing deposited assets.
- Transferring iTokens to the same address credited the transfer without correctly applying the debit, increasing the holder's balance.
- The inflated balance could be redeemed for assets the holder had never deposited.
- bZx paused minting and burning, fixed the accounting and corrected duplicated balances.
Protocol details
Security review history
- ZK Labs No public report
- CertiK No public report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
