FEG SmartBridge Hack
What happened
On December 29, 2024, an attacker withdrew FEG tokens without matching deposits from FEG SmartBridge on Ethereum, Base, and BNB Chain. CertiK traced the failure to FEG's message-verification logic, not Wormhole itself. Its analysis estimates about $1 million in attacker proceeds; the incident feed records approximately $1.07 million in losses.
The relayer treated an admin address inside an untrusted message payload as authority to whitelist the message's source contract.
How it happened
The attacker first sent a message containing the admin address, causing the relayer to trust an attacker-controlled contract. A second message registered an unbacked withdrawal balance. The attacker then withdrew FEG and sold it for native-chain assets.
CertiK reconstructed the authorization flaw from decompiled, unverified relayer code. The linked Base transaction provides a concrete withdrawal record. For reviewers, the key check is whether authorization comes from an authenticated sender, rather than a user address asserted inside the message.
Protocol details
Security review history
- Solidity Finance View report
Evidence
- report @Phalcon_xyz incident report x.com
- transaction Base: FEG bridge withdrawal transaction basescan.org
- analysis DeFiLlama defillama.com
- analysis CertiK: FEG Bridge Exploit Technical Analysis certik.com
- analysis Protos: FEG token holders in despair after third hack causes 99% dump protos.com
- analysis CertiK: FEG bridge exploit technical analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
