Incident Overview
On August 7, 2024, Nexera Fundrs experienced an exploit that led to the unauthorized transfer of 47.24 million NXRA tokens from its smart contracts, with approximately 14.75 million tokens sold, valued at around $449,000.
The incident occurred when an external actor gained unauthorized access to the credentials for managing Nexera Fundrs’ smart contracts. Utilizing this access, the attacker transferred NXRA tokens from the Fundrs staking contracts on Ethereum and accessed the vesting contract on Avalanche. Despite the breach, the attackers were unable to access NXRA tokens stored in users' wallets.
Upon detecting the incident, the Nexera team promptly paused the NXRA token contract, halting all on-chain transactions. They also removed the remaining 32.5 million NXRA tokens from the attacker’s wallet, mitigating further potential losses. The attackers exploited BeaverTail malware, a method consistent with state-backed threat actors, to deploy the attack.
Exploiter:
https://etherscan.io/address/0xe6979498…580a10
Example of swap tx:
https://etherscan.io/tx/0xb4e6fdf9…63721c
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Nexera, these are the critical security checks that could have prevented this incident (August 2024).
- Verify all logic paths related to Ownership Override Attack / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Nexera
The Nexera hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.