Loopring Hack
Reported loss
$5.0M
Compromised guardian recovery service
What happened
On June 9, 2024, an attacker took over 58 Loopring Smart Wallet addresses through the Official Guardian recovery service. Loopring's final report describes unauthorized changes to users' two-factor authentication records, allowing recovery codes to reach the attacker.
Technical root cause
Compromised 2FA records let an attacker obtain guardian approval for unauthorized wallet recovery.
How it happened
- The attacker obtained read/write access to the 2FA service and substituted their email addresses.
- Recovery codes were delivered to the attacker, allowing Official Guardian approval.
- Wallet ownership was reset and assets drained.
- Loopring paused affected recovery services and later added human review.
Protocol details
Classification
Infrastructure / Wallet Recovery
Protocol Type
DEX
Protocol links
Website
@loopringorg
Security review history
- SECBIT Labs View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
