What happened
On December 29, 2024, an attacker drained FEG's SmartBridge on Ethereum, Base and BNB Chain. The bridge used Wormhole to carry cross-chain messages, but the flaw sat in FEG's own relayer contract: it did not properly check who a bridge message came from. The attacker sent crafted messages that first added their own contract to the relayer's whitelist and then registered a fake withdrawal balance of about 45.7 billion FEG, which the SmartBridge paid out without any matching deposit.
The attacker, 0xCB96ddE53F43035f7395D8DbdB652987F7630b3c on all three chains, swapped the tokens for 96.3 ETH on Ethereum, 73.3 ETH on Base and 712 BNB on BNB Chain, about $1 million in total by CertiK's estimate, and routed proceeds to Tornado Cash. The FEG price collapsed by about 99%. FEG first suspected Wormhole, but CertiK's analysis placed the flaw in FEG's own relayer, not in Wormhole's contracts.
No recovery or compensation has been reported.
How it happened
- The FEG Relayer accepted Wormhole-delivered messages and could authorize SmartBridge withdrawals, but it did not verify that a message's source address was a legitimate FEG bridge contract.
- The attacker's first message carried an admin user field in its payload, which the relayer accepted as a request to whitelist the attacker's contract as a source.
- A second message from the now-whitelisted source called
registerWithdraw, crediting the attacker with a withdrawal balance of about 45.7 billion FEG with no deposit on the source chain. - The attacker withdrew the FEG from SmartBridge on each chain, swapped it for ETH and BNB, and moved proceeds toward Tornado Cash.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
