What happened
Qubit Finance's Ethereum-to-BNB Smart Chain QBridge was exploited on January 27, 2022. The attacker induced the Ethereum bridge to emit deposit events without receiving tokens, then used the resulting unbacked qXETH as lending collateral on BNB Smart Chain to borrow real pool assets. Incident analyses put the loss at about $80 million.
A generic ERC-20 deposit path remained callable for the native ETH resource after its token mapping was changed to the zero address. Successful completion of a low-level token call was treated as proof of transfer, allowing a zero-value call to generate a bridge deposit event. Native-asset and ERC-20 routes must be mutually exclusive, and bridge messages must be tied to verified asset movement.
Case & protocol details
Attack Timeline
Qubit had introduced a dedicated depositETH() route but left the older generic ERC-20 deposit() route reachable. For the ETH resource, its token address had been changed to address(0). The generic route's low-level transfer call to that address did not fail or move tokens, yet the route emitted the deposit event that Qubit's relayer treated as a valid bridge deposit.
The attacker made 16 such Ethereum calls, and the relayer submitted 16 corresponding BNB Smart Chain proposals that minted unbacked qXETH. The attacker supplied that qXETH as collateral and borrowed real WETH, BTCB, stablecoins, and other assets from Qubit's pools.
Security review history
- PeckShield Report
Evidence & learning
Proof of concept
1 availableSources and on-chain records
- report Post-mortem rekt.news
- report Post-mortem medium.com
- report Report archive.is
- report Post-mortem medium.com
- transaction Transaction etherscan.io
- transaction Transaction bscscan.com
- transaction Transaction etherscan.io
- analysis Block Explorer etherscan.io
- analysis CertiK analysis of the Qubit bridge exploit certik.medium.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.