NEKO Hack

Neko Network, the experimental lending network of Maze Protocol on BNB Smart Chain, was attacked from August 11, 2021 (21:39 UTC). Attackers used a flaw in the closed-source MainPool lending contract to borrow against other users' collateral and receive the loans themselves. According to Maze's incident report, six attacker addresses (two using helper contracts) made more than 190 malicious borrows. Together they added 499,423 BUSD, 3,620,179 USDT, 2,792 USDC and 1 BTCB of debt to 16 victim accounts, about $4M in total. About $3.8M of that debt landed on a single whale's account and $296K on the rest. Only the Funding Pools lost money; the Reserve Pools and LP Pool do not lend and were not affected.

Maze froze the pools, which stayed closed for at least 24 hours because of a timelock. The attackers returned about $3.8M to the team's deployer address, and by August 16 the team had sent it to victims to repay their fraudulent debts. The whale ended with a 7% loss on their deposit, and other accounts were made whole. Maze noted that the contract had never been open-sourced or verified on BscScan, and that one attacking contract was deployed about five days before the Neko contract, so the attackers probably had access to the code. The protocol had been audited twice before launch.