Particle Trade Hack

Reported loss $142K
Ethereum
Other

What happened

On 15 February 2024 an attacker drained about 50.1 ETH (roughly $140K at the time) from a deprecated NFT lending contract of Particle Trade, a leveraged trading protocol on Ethereum. BlockSec lists the root cause as unverified user input.

The contract's onERC721Received() callback trusted the lien data passed to it. The attacker called it directly with forged lien data and a fake NFT contract, which made the protocol treat a fabricated loan as legitimate and credit the attacker's accountBalance. The attacker then withdrew that balance as ETH.

Attacker address: 0x2c903f97ea69b393ea03e7fab8d64d722b3f5559. Attack contract: 0xe55607b2967ddbe5fa9a6a921991545b8277ef8f. The setup transaction was 0xd9b3e229acc755881890394cc76fde0d7b83b1abd4d046b0f69c1fd9fd495ff6 and the withdrawal was 0x2cc3c3cfbdf04441f3349e49768c909ac252ace6f78b24a25d4700a47883514a. Within about 15 minutes the attacker began depositing the ETH into Tornado Cash, for example in 0x4bb78bbf3305ab38464fd6a210e64cb3d5f6b672eeb10ed5953ec07db447bcc4 and 0x32fe57bd3bf9554d1e4d93c09207027c84886179884c6668b05883c0f5220894.

How it happened

  1. The attacker deployed a contract that pretends to be an NFT collection, implementing its own ownerOf() and safeTransferFrom().
  2. Through that contract the attacker called offerBid() on the Particle contract to create a bid and get a lien ID (lien 76 in the setup transaction).
  3. The attacker called onERC721Received() directly, twice, with crafted Lien data (the second time filling in tokenId and loanStartTime). The contract accepted the data without checking that a real NFT transfer had happened, so the forged lien was accepted and the attacker's accountBalance was credited.
  4. The attacker called withdrawAccountBalance() and received about 50.13 ETH, then moved the funds to Tornado Cash.

Protocol details

Classification Other / Input Validation
Protocol Type Exploit/Other
Implementation language Solidity
Protocol links Website @particle_trade

Evidence

Same attack technique

Browse all hacks →
Ethereum MINER $467K lost Ethereum Socket $3.3M lost Ethereum Time $200K lost BNB Chain OMNI Real Estate $70K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes