What happened
The attacker's address:
https://etherscan.io/address/0x5676e585…a5f1a3
The transaction behind the exploit:
https://etherscan.io/tx/0xf3158a7e…c50713
NowSwap hack was made possible by an error when updating the smart contract’s code. The original code of the contract contained a value, K, of 1,000 in three different places. The update to the code changed this value in two places but not the third.
This third location was a check of the value of K, but it only checked for a value 1/10 of the actual value. This enabled the attacker to swap 1 wei for 98% of the value stored in the contract.
Stolen funds were deposited into Tornado Cash mixer:
https://bloxy.info/txs/calls_from/0x5676e585…a5f1a3?signature_id=994162&smart_contract_address_bin=0x722122df…5b6967
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report x.com
- analysis Website reference twitter.com
- analysis Website reference halborn.com
- analysis Website reference twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.