Keep3r Network Hack
What happened
On June 12, 2023, an attacker took about 4,084 KP3R (around $200,000) from Keep3r Network contracts on Ethereum after obtaining the private key of an address that acted as governor for several of its pools.
The governor was a vanity address. BlockSec attributed the attack to that key being compromised, and Protos reported that the address had been generated with Profanity, the vanity-address tool whose weak key generation was disclosed in 2022 and let attackers brute-force private keys. With governor rights, the attacker reset the governor of several pools and, according to BlockSec, then used a reentrancy attack to pull out the KP3R.
MetaSleuth traced the attacker's initial funding to Tornado Cash and noted extensive interaction with Binance. No team post-mortem or recovery was found.
**Block data**
- Attacker: 0x4941f075d77708b819e9f630f65d65c3289e7c9e
How it happened
- The attacker, funded through Tornado Cash, obtained the private key of Keep3r's vanity governor address, reportedly generated with the vulnerable Profanity tool.
- Using the governor role, they reset the governor of several Keep3r pools to addresses they controlled.
- They then drained the pools through what BlockSec described as a reentrancy attack, netting about 4,084 KP3R (~$200,000).
Protocol details
Security review history
- PeckShield View report
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
