FEG SmartBridge Hack
What happened
On December 29, 2024, an attacker withdrew FEG tokens without matching deposits from FEG SmartBridge on Ethereum, Base, and BNB Chain. CertiK traced the failure to FEG's message-verification logic, not Wormhole itself. Its analysis estimates about $1 million in attacker proceeds; the incident feed records approximately $1.07 million in losses.
The relayer treated an admin address inside an untrusted message payload as authority to whitelist the message's source contract.
Case & protocol details
How it happened
The attacker first sent a message containing the admin address, causing the relayer to trust an attacker-controlled contract. A second message registered an unbacked withdrawal balance. The attacker then withdrew FEG and sold it for native-chain assets.
CertiK reconstructed the authorization flaw from decompiled, unverified relayer code. The linked Base transaction provides a concrete withdrawal record. For reviewers, the key check is whether authorization comes from an authenticated sender, rather than a user address asserted inside the message.
Security review history
- Solidity Finance Report
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- transaction Base: FEG bridge withdrawal transaction basescan.org
- analysis CertiK: FEG Bridge Exploit Technical Analysis certik.com
- analysis Protos: FEG token holders in despair after third hack causes 99% dump protos.com
- analysis CertiK: FEG bridge exploit technical analysis certik.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
