What happened
On February 18, 2020, bZx's sUSD pricing path was manipulated in a single flash-loan transaction. The attacker inflated sUSD's value in the protocol's oracle path, borrowed against overvalued collateral, and netted 2,378 ETH (about $665,840 at the time).
bZx relied on a manipulable Kyber-routed spot price for sUSD in collateral valuation. A flash loan made it possible to distort that price and borrow more ETH than the collateral was worth at an unmanipulated rate.
How it happened
The attacker borrowed 7,500 ETH through bZx, accumulated sUSD, and used Kyber-routed swaps to raise the sUSD price seen by bZx. With more than one million sUSD valued at the manipulated rate, the attacker posted it as collateral and borrowed 6,796 ETH. The flash loan was repaid in the same transaction, leaving an underwater bZx position and 2,378 ETH in profit.
The issue was not flash loans alone: a manipulable spot price was accepted as a lending valuation input.
Protocol details
Evidence
- report Report coindesk.com
- report @bneiluj incident report twitter.com
- transaction Etherscan: bZx Hack II transaction etherscan.io
- analysis PeckShield: bZx Hack II Full Disclosure peckshield.medium.com
- analysis DeFiLlama defillama.com
- analysis bZx attacked again, $645K in ETH estimated to be lost theblock.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
