Incident Overview
Exchange aggregator Dexible was exploited resulting in the loss of over $2,000,000 worth of $ETH
Dexible is a multichain exchange aggregator, that provides a CEX trading experience and tools while being fully decentralized. On February 17th, the Dexible v2 contracts were exploited. The attacker had used the app’s selfSwap() function to move over 2,000,000 $USD worth of crypto from users who had authorized the app to move their tokens.
The malicious actor was able to encode the transferFrom() function into the calldata of multiple transactions, getting access to the user's tokens and draining them. The malicious transactions were coming from Dexible, which users had already authorized to spend their tokens, so the token contracts did not block the transactions. 17 users were affected in total, 4 of them were trading on the Ethereum mainnet, and lost 930.6 $ETH which is worth 1,498,266 $USD at the moment.
According to some sources, all the lost funds from the Ethereum chain belonged to the BlockTower Capital investment firm. The rest of the affected users are on the Arbitrum layer-2 chain. After receiving the tokens into their own smart contract, the attacker swapped them to $ETH and transfer the funds through Tornado Cash into unknown BNB wallets.
Dexible has since paused their contracts and urged users to revoke token authorizations for them.
Attacker address:
https://etherscan.io/address/0x684083f3…aab77a
Funds transfer example transaction:
https://etherscan.io/tx/0x4393ca72…686a8c
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Dexible, these are the critical security checks that could have prevented this incident (February 2023).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Solidified Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Dexible
The Dexible hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.