Fortress Loans Hack

TOTAL LOST $3.0M
Medium Governance and Oracle Exploit / Other bsc

Summarize with AI

ChatGPT Perplexity Claude Grok
Affected Chain bsc Incident surface
Recovered - No recovery reported
All-Time Rank #548 By amount stolen
Auditors 2 Prior security audits

Incident Overview

Quick Summary

Fortress Loans was attacked due to oracle vulnerability. An attacker was able to manipulate the project's oracle which allowed them to borrow differrent number of tokens for the amount of ~$3m (~1k ETH and 400k DAI).

Details of the Exploit

Fortress Protocol is a decentralized marketplace for Lenders and Borrowers with Borderless Stablecoins. Fortress Loans became a victim of attacker that manipulate with the price oracle, which made possible to get about $3m and launder them through the TornadoCache.

Attack flow:

Attacker created unverified smart-contract (https://bscscan.com/tx/0x4800928c…af5039) which was later used to send a series of transactions (https://bscscan.com/tx/0x13d19809…b061bf).

A series of transactions allowed them to propose Fortress Governor Alfa contract with a malicious proposal, for which they themselves voted to set the FTS extremely valuable. The attacker then borrowed a huge amount of tokens that exchanged for ETH and DAI. Then all stollen funds were transferred across the bridge to the Ethereum network and laundered via TornadoCache.

As the time of this writing information on this case is scarce. More sources will be added if the case should develop.

Block Data Reference

Attacker address on BSC: https://bscscan.com/address/0xA6AF2872…5d22Ad

Attacker address on ETH. Here all the stolen funds were laundered through TornadoCache: https://etherscan.io/address/0xA6AF2872…5d22Ad

Bridging transaction from BSC to ETH:

BSC: https://bscscan.com/tx/0x36fd458d…7e9eea

ETH: https://etherscan.io/tx/0xcf852b02…543af5

Attacker's smart-contract (BSC): https://bscscan.com/address/0xcd337b92…463a45

Attack transaction: https://bscscan.com/tx/0x13d19809…b061bf

This is classified as a Oracle Manipulation & Price Manipulation . Compare similar hacks →

Incident Report

Protocol / Project Fortress Loans
Date of Incident
Affected Chain(s) bsc
Attack Technique Governance and Oracle Exploit / Other
Classification Protocol Logic / Borrowing and Lending
Primary Source View Post-Mortem

Protocol Information

Protocol Type Lending
Affected Token FTS
Smart Contract Language Solidity
Official Website bsc.fortress.loans/dashboard
Protocol Twitter/X @Fortressloans
Team Anonymous
Source Code Verified On-Chain

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of governance and oracle exploit / other and Solidity and EVM internals
Capital Required Seed capital to cover gas and initial position setup
On-Chain Access Ability to interact with bsc smart contracts and deploy a custom exploit contract
Protocol Analysis Identification of the exploitable vulnerability in Fortress Loans's contract logic - root cause: protocol logic / borrowing and lending
Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block
Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Yes — skilled auditors routinely flag Governance and Oracle Exploit / Other vulnerabilities in code review
Audited by Ether Authority, HashEx — still lost $3.0M. Prior audits don't guarantee safety, especially after post-audit code changes.

If you're auditing a protocol with similar architecture to Fortress Loans, these are the critical security checks that could have prevented this incident (May 2022).

  • Verify all logic paths related to Governance and Oracle Exploit / Other are guarded by proper access controls and input validation - see the Oracle Manipulation & Price Manipulation attack class for patterns
  • Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
  • Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Security Audit History

Related Attack Classes

The technique used in this hack maps to these vulnerability classes in our security curriculum:

See all Oracle Manipulation & Price Manipulation examples →

Oracle Manipulation & Price Manipulation

Proof-of-Concept Exploits

1 PoC available
poc-exploits - fortress loans
$ Fortress Loans Malicious Proposal & Price Oracle Manipulation

On-Chain Evidence & References

Sources & References

Learn to Prevent the Next Fortress Loans

The Fortress Loans hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library
Recreate exploit patterns safely Free Trial