What happened
DEXX users suffered wallet thefts on November 16, 2024. PandaLY's on-chain analysis attributed the incident to private-key leakage and documented SOL and token transfers from affected wallets. Its report did not establish the exact route by which the attacker obtained the keys.
Immunefi's November loss report estimated $21 million.
Technical root cause
The key-management failure enabled direct wallet transactions. Server compromise and interception of key exchanges were possibilities raised by the analysis, not proven entry points.
How it happened
- Access to user signing keys enabled unauthorized transfers from DEXX-associated wallets.
- The observed transfers used several patterns: token transfers followed by SOL withdrawals, SOL-only withdrawals, and transfers to newly created addresses.
- Some affected wallets received small SOL amounts before additional token transfers, consistent with funding transaction fees.
Protocol details
Classification
Infrastructure / Key Compromise
Protocol Type
Exploit/Other
Protocol links
Website
@DEXXai_EN
Evidence
- report @DEXXai_EN incident report x.com
- report @MistTrack_io incident report x.com
- report DEXX theft incident chain tracking and analysis report panews.io
- report Immunefi Crypto Losses November 2024 Report immunefi.com
- analysis Website reference binance.com
- analysis Website reference bravenewcoin.com
- analysis Website reference cointelegraph.com
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
