Evoq Finance Hack

On September 9, 2025, Evoq Finance on BNB Chain was exploited for approximately $420,000 after attackers compromised the owner account's private key. The attackers transferred ownership to themselves, upgraded the proxy contract to a malicious implementation, and drained funds from both the protocol and user token approvals.

The attack was executed through a sophisticated multi-step process beginning with the compromise of the owner account's private key (0xF08d1c). The attackers used the stolen credentials to call the transferOwnership() function, transferring control to their own address (0x7b416F). With ownership secured, they employed the upgradeAndCall() function to upgrade the proxy contract to a malicious implementation that enabled fund drainage.

The malicious contract systematically drained approximately $420,000 from both the protocol's treasury and users who had previously granted token approvals to the contract. This attack highlights critical vulnerabilities in single-key ownership models for DeFi protocols, where compromise of a single private key can lead to complete protocol takeover. GoPlus Security has urged all users to immediately revoke token approvals for the exploited contract to prevent further losses and recommended that projects implement multi-signature wallets for admin functions along with regular key rotation practices.

Exploit tx:

https://bscscan.com/tx/0x107911f6…58ae62