NewDex Hack

Newdex, an exchange on EOS that billed itself as decentralized, lost about $58,000 of users' funds in September 2018 to a counterfeit-token attack. On September 14, 2018, EOS account oo1122334455 created its own token with the symbol "EOS" and a supply of 1 billion, matching the real EOS supply. Newdex did not check which contract a deposited "EOS" came from, so the attacker used about 11,800 fake EOS to fill real users' sell orders for BLACK, IQ and ADD. The attacker then sold those tokens for genuine EOS, netting about 11,803 EOS by one recap, and sent 4,028 real EOS (about $20,000) to Bitfinex.

Reporting at the time noted that deposits did not pass through a smart contract that could validate tokens. Users sent funds to newdexpocket, a regular account controlled by Newdex, so the exchange worked more like a custodial service than a DEX. Newdex confirmed the attack and apologized. As of September 18-21, it had no concrete plan to reimburse victims.