What happened
SOMESING reported that approximately 730 million SSX was withdrawn from 18 foundation wallets on January 27, 2024. Its later account attributed the compromise to a phishing attachment opened by a staff member. Stolen reserves entering circulation disrupted the project's published supply plan.
Technical root cause
The project's account supports a phishing-related operational compromise and unauthorized withdrawals. It does not demonstrate an unbacked-mint vulnerability.
How it happened
- A January 16 email impersonated a Korean exchange and reached an employee handling exchange communications.
- The employee executed its attachment on January 17. SOMESING's later investigation linked this to the compromise.
- Tokens left foundation wallets on January 27.
- SOMESING worked with Uppsala Security and exchanges to trace transfers and reported account freezes at HTX and Gate. Frozen accounts did not by themselves confirm recovery.
Protocol details
Classification
Access Control
Protocol Type
DeFi Protocol
Implementation language
Solidity
Protocol links
Website
@somesinglovers
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
