RocketSwap Base Hack
Reported loss
$869K
Private Key Compromised (Brute Force)
What happened
RocketSwap, a decentralized exchange on Base, reported that an attacker stole 471 ETH, valued at about $870,000, from its yield farm. The team attributed the incident to private keys held on a cloud server being obtained in a brute-force attack.
How it happened
- RocketSwap said offline signatures used during launchpad deployment left private keys on a cloud server.
- The team said a brute-force attack on that server exposed the keys and enabled transfers from the yield farm through a proxy contract with high-risk permissions.
- PeckShield reported a loss of 471 ETH; reporting also tracked the attacker moving assets to Ethereum and creating the LoveRCKT memecoin.
Protocol details
Classification
Infrastructure / Exchange (DEX) / Frontend & Infrastructure
Protocol Type
DEX
Affected asset / contract
RCKT
Implementation language
Solidity
Protocol links
Website
@RocketSwap_Labs
Evidence
- report @Cointelegraph incident report twitter.com
- report @PeckShieldAlert incident report twitter.com
- report @RocketSwap_Labs incident report twitter.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis Hacker creates memecoin after stealing $870,000 from RocketSwap on Base theblock.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
