Particle Trade Hack
Incident Overview
Particle trade, a decentralized leverage trading protocol, was exploited, resulting in the loss of 141,684 USD worth 50.12 WETH.
Particle trade is a permissionless decentralized leverage trading protocol for any digital asset. On February 15, 2024, the project was exploited due to a contract vulnerability in its previously deprecated NFT contract. The contract does not check the user input data for onERC721Received() function which make the order 'legit' and manipulated the accountBalance.
The current protocol of Particle trade was not impacted by this security incident, confirmed by @wukong_particle in a post on the X. The attacker deposited the stolen funds into TornadoCash.
Attacker Address:
https://etherscan.io/address/0x2c903F97…3f5559
Malicious Transaction:
https://etherscan.io/tx/0x2cc3c3cf…83514a
Malicious Contract Address:
https://etherscan.io/address/0xE55607B2…77Ef8F
TornadoCash Deposit Transactions:
https://etherscan.io/tx/0x4bb78bbf…47bcc4
https://etherscan.io/tx/0x32fe57bd…220894
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Particle Trade, these are the critical security checks that could have prevented this incident (February 2024).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
-
02
Web Archive https://archive.is/0H41z
Learn to Prevent the Next Particle Trade
The Particle Trade hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.