Quixotic Hack

Reported loss $200K
Optimism
Other

What happened

On 2022-07-01 an attacker drained ERC-20 tokens, mainly OP and USDC, from users of Quixotic, then the largest NFT marketplace on Optimism. These users had approved the marketplace contract to spend tokens so they could make offers, and a recently updated version of the contract let anyone spend those approvals. Apetimism warned about attacks on the Offer feature at about 05:36 UTC.

One researcher counted 688 affected accounts. The largest reported transfers out were 110,756 USDC and 170,882 OP. CryptoSlate put the total at over $100K; the same researcher estimated around 214K OP lost.

Quixotic paused the marketplace and promised to refund all stolen ERC-20 tokens. NFTs were not affected.

How it happened

  1. The attacker deployed its own NFT contract and signed a sell order for one of its tokens, naming OP as the payment token.
  2. The attacker called fillSellOrder on the Quixotic contract and passed a victim's address as the buyer parameter.
  3. The function checked only that the sell order carried a valid seller signature. It never checked that the buyer had signed or agreed to the purchase.
  4. The contract then sent the attacker's worthless NFT to the victim and pulled the price from the victim's wallet with their existing ERC-20 approval, paying it to the attacker as seller.
  5. The attacker repeated this against many wallets with open approvals, in OP, USDC and other offer currencies.

Protocol details

Classification NFT / Input Validation
Protocol Type Exploit/Other
Implementation language Solidity
Protocol links Website @qx_app

Evidence

Same attack technique

Browse all hacks →
Cardano Wanchain $10.0M lost Arbitrum Lumi Finance $270K lost Ethereum Multichain $147K lost BNB Chain ApolloX $2.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes