What happened
Around October 13, 2022, an attacker made the centralized exchange FTX pay for thousands of XEN token mints by abusing its free ETH withdrawals. FTX's hot wallet paid about 81 ETH in gas, which crypto.news valued at $103,443, and the attacker minted more than 100 million XEN.
FTX charged no withdrawal fee, allowed withdrawals to contract addresses, and did not cap the gas limit of withdrawal transactions. It set the limit with gas estimation, which typically came out around 500,000 gas instead of the 21,000 a plain ETH transfer needs. When FTX sent ETH to the attacker's contract, the contract's fallback code used that gas to create one to three sub-contracts that each minted XEN and then self-destructed. FTX, as the sender, paid for all of it.
The attacker repeated this about 17,000 times, then sold XEN for about 61 ETH via DODO and Uniswap. crypto.news estimated the attacker's profit at $77,618. The activity was flagged publicly by WuBlockchain, and FTX had not stopped it when the first reports were published.
**Block data**
- Attacker: 0x1d371cf00038421d6e57cfc31eeff7a09d4b8760
How it happened
- The attacker deployed a contract whose fallback function, on receiving ETH, creates sub-contracts that call XEN's mint/claim functions and then self-destruct.
- They requested ETH withdrawals from FTX to that contract address. FTX allowed contract recipients and charged no fee.
- FTX's hot wallet sent each withdrawal with an estimated gas limit around 500,000, so the attacker's code had plenty of gas to run the XEN mints at FTX's expense.
- Repeating this about 17,000 times, the attacker minted over 100 million XEN while FTX paid about 81 ETH in gas.
- The attacker swapped XEN for about 61 ETH on DODO and Uniswap.
Protocol details
Evidence
- report Post-mortem medium.com
- transaction Etherscan transaction 0xfb1a7b35...107d etherscan.io
- address etherscan.io address 0x56af…cf45 etherscan.io
- address etherscan.io address 0x6438…4a3d etherscan.io
- address etherscan.io address 0x6b01…b831 etherscan.io
- analysis FTX Loses Over 100 Million XEN and 81 ETH in a Hack crypto.news
- analysis DeFiLlama defillama.com
- analysis Gas Theft on FTX: Hackers Steal 81 ETH by Minting XEN unchainedcrypto.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
