What happened
On August 17, 2022, attackers hijacked traffic to Celer Network's cBridge frontend for about three hours and served users malicious contracts that drained approved tokens. Celer first described it as DNS hijacking. Later network analyses by Coinbase and Kentik traced it to a BGP hijack of the Amazon IP range hosting part of the cBridge backend.
Losses were about 128 ETH, reported as $235,000 to $240,000. The stolen funds went to Tornado Cash. Celer said its protocol and smart contracts were not compromised.
It took the frontend offline, told users to revoke approvals to the malicious contracts, promised full compensation, and restored the frontend with extra monitoring on August 18.
How it happened
- On August 16, 2022, the attacker created or changed routing-registry entries for the hosting provider QuickHostUK in AltDB, a free IRR database. The entries included a route object for
44.235.216.0/24that listed Amazon's AS16509 as origin. - From about 19:39 UTC on August 17, that Amazon-owned /24 was announced through QuickHostUK (AS209243). Networks that accepted the announcement sent traffic for the cBridge infrastructure hosted in that range to the attacker.
- The attacker's server posed as part of the cBridge backend and gave frontend users crafted contracts that asked them to approve or transfer tokens.
- Between about 19:51 and 21:49 UTC, users who signed these transactions had their approved tokens drained.
- The route was withdrawn and re-announced several times before disappearing for good at 22:07 UTC. Celer disabled the frontend, and the proceeds were sent to Tornado Cash.
Protocol details
Evidence
- address arbiscan.io address 0x9c8b…c9f9 arbiscan.io
- address aurorascan.dev address 0x9c8b…c9f9 aurorascan.dev
- address bscscan.com address 0x5895…e7CF bscscan.com
- address etherscan.io address 0x2A2a…18E8 etherscan.io
- address polygonscan.com address 0x9c8b…c9f9 polygonscan.com
- address snowtrace.io address 0x9c8b…c9f9 snowtrace.io
- analysis An Estimated 128 ETH Lost in the Celer Protocol DNS Attack cryptopotato.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
- analysis What can be learned from recent BGP hijacks targeting cryptocurrency services? kentik.com
- analysis Celer Network cBridge resumes operation after suffering DNS exploit cryptoslate.com
- analysis astar.subscan.io address 0x9c8B…c9F9 astar.subscan.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
