What happened
Narwhal's NRW token experienced two major sell-offs on BNB Chain in January 2024, removing approximately $1.5 million in assets. The project called the incident a hack. CertiK traced connections between both flows and the deployer's associated wallets, concluding that an exit scam was more likely.
The second withdrawal authenticated a signature against a signer address changed by the contract creator shortly beforehand. This shows how the withdrawal was authorized, but does not establish a stolen key. CertiK's likely-exit-scam conclusion also relied on links to the separate token consolidation and sale.
How it happened
- A wallet consolidated NRW from hundreds of funded wallets and sold the tokens.
- A second withdrawal used an accepted signature to remove NRW from a contract created by the Narwhal deployer.
- Proceeds from the sell-offs were linked and bridged to Ethereum, where funds entered Tornado Cash.
- CertiK connected both flows to wallets associated with the deployer.
Protocol details
Evidence
- report @Narwhal_fyi incident report twitter.com
- analysis Narwhal Incident certik.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
