Incident Overview
On September 1, 2025, OlaXBT detected unauthorized withdrawals of approximately 32 million AIO tokens from their multisig wallets. The attacker sold the stolen tokens for over $2 million, prompting OlaXBT to activate emergency protocols, engage cybersecurity experts, and coordinate with exchanges to mitigate market impact while developing a compensation plan for affected token holders.
The attack involved sophisticated techniques targeting OlaXBT's multisig wallet infrastructure, resulting in the unauthorized withdrawal of approximately 32 million AIO tokens. The exploiter immediately began liquidating the stolen tokens, converting them to over $2 million in value through market sales. OlaXBT responded by activating emergency response protocols and engaging BlockSec and other leading cybersecurity firms for investigation and forensic analysis.
The team identified evidence of coordinated unauthorized access through blockchain forensics, examining transaction patterns and wallet interactions to trace the exploit. The vulnerability in the wallet system has been reportedly resolved, and OlaXBT is working with global law enforcement agencies to pursue legal action and recovery efforts. The project team is developing a compensation plan for verified AIO holders who held tokens prior to the incident, with details including snapshot block, eligibility criteria, and distribution timeline to be announced after auditor consultation.
q
Exploiter:
https://etherscan.io/address/0x0738c5bf…cbd9ef
https://etherscan.io/address/0xec75a0bb…74348c
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to OlaXBT, these are the critical security checks that could have prevented this incident (September 2025).
- Verify all logic paths related to Multisig wallet Social Engineering Exploit / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next OlaXBT
The OlaXBT hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.