Custom Lending Pool Hack

Custom lending pool on Binance Smart Chain exploited due to approval issue, resulting in a loss of 366,058 USDT.

A custom lending pool running on the Binance Smart Chain was exploited on November 12, 2023, due to an approval issue in the smart contract. The attacker was able to drain approved funds from the victim contract, totaling 366,058 USDT. The exact cause of the exploit is hard to define, as the contract is not verified and the source code is not available.

The stolen funds were bridged to the Ethereum mainnet via Stargate Bridge and swapped for DAI and WETH. These funds were then deposited into Railgun Relay, a private wallet on the Ethereum network.

Attacker Address:

https://bscscan.com/address/0x69e068eb…21cea0

Malicious Contract Addresses:

https://bscscan.com/address/0x69e068eb…21cea0

https://bscscan.com/address/0x3918e0d2…006108

Victim Contract Address:

https://bscscan.com/address/0x8c2d4ed9…95ffe7

Malicious Transaction:

https://bscscan.com/tx/0x3dcb26a1…c8c9b3

Bridging Transactions:

https://bscscan.com/tx/0x9f2cc9f6…b02532

https://etherscan.io/tx/0xd4d7f80f…124310

Railgun Deposit Transactions:

https://etherscan.io/tx/0xae1ad836…095b7f

https://etherscan.io/tx/0xc55b3285…3e8322