StepHeroNFTs Hack

On February 21, 2025, the inactive StepHeroNFTs project on BSC was exploited via a reentrancy vulnerability in the claimReferral() function, leading to a loss of approximately $90,000.

The attacker exploited a reentrancy vulnerability in the claimReferral() function, which transferred funds before updating the referral balance. By recursively calling the function, the attacker drained the contract’s assets in a single transaction before state changes could be finalized. The attacker self-referred purchases to inflate rewards and used an external call (0x2d1e) to withdraw repeatedly.

Since the victim contract was unverified, the source code was unavailable, but reverse engineering confirmed the flaw.