What happened
On November 2, 2022, Rubic reported that an administrator wallet managing the RBC/BRBC bridge and staking rewards was compromised, with malware suspected as the route to the private key. About 34 million RBC and BRBC were sold on Uniswap and PancakeSwap. Contemporary reporting valued the transferred tokens at over $1.2 million; Rubic said user staking funds were safe and no smart contract had been exploited.
How it happened
- An administrator wallet handling bridge and staking-reward functions was compromised.
- Rubic suspected malware obtained the wallet's private key.
- The attacker transferred and sold roughly 34 million RBC and BRBC on Uniswap and PancakeSwap.
- Rubic reported that user staking funds remained safe and that no smart contract was exploited.
Protocol details
Classification
Bridge / Exchange (DEX) / Key Compromise
Protocol Type
DEX Aggregator
Category
Bridge Hack
Affected asset / contract
BRBC
Protocol links
Website
@CryptoRubic
Security review history
- CertiK View report
- Fairyproof View report
Evidence
- report @CryptoRubic incident report twitter.com
- analysis DeFiLlama defillama.com
- analysis Cross-Chain DEX Rubic Loses Over $1M in Funds After Hackers Gain Access to Private Keys coindesk.com
- analysis The private key of the Rubic multi-chain exchange protocol administrator wallet is suspected to have been leaked chaincatcher.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
