What happened
On January 25, 2024, an attacker took control of an admin role on Swarm Markets' legacy Ethereum platform and used it to drain its xTokenWrapper contract, which held the SMT, WETH, USDC and DAI backing Swarm's wrapped xTokens. Swarm traced the root cause to a 2022 migration from an external vendor's pilot platform: the handover procedure omitted one role, which was never transferred away from the vendor side. Swarm said it was unclear whether the omission was malicious or whether anyone linked to the vendor was involved.
A white-hat MEV bot spotted the attack and front-ran most of the withdrawals, securing 168 WETH and 4,255,905 SMT, which it returned to Swarm in exchange for a 5% bounty. The attacker was left with 472,891.80 SMT, 7,826.70 DAI and 3,234.50 USDC, about $120,000 by Swarm's estimate, and swapped 427K SMT into about 54 WETH. Swarm suspended the Ethereum platform, reported the attacker wallets to analytics firms and exchanges, and said the Ethereum AMM pools had been restored to their pre-exploit state by February 2, 2024. On February 22, 2024, another address reused the attacker's fake xToken contracts to unwrap about 7.7K more DAI and USDC from the wrapper.
How it happened
- At 05:31:47 UTC on January 25, 2024, the attacker used the leftover role to transfer ownership of the Proxy Admin to their address
0x959E2CC532115d0a86e24EB2977D93Df6202560E. - Using the Proxy Admin, they upgraded the Action Manager proxy to a malicious
Callercontract whose only job was to callregisterTokenon thexTokenWrapper. - Through
Caller, the attacker re-mapped SMT, WETH, USDC and DAI to fake xToken contracts they had deployed, which anyone could mint freely. - The attacker minted fake xTokens and called
unwrapto withdraw the real underlying tokens from the wrapper. A white-hat MEV bot copied the withdrawals and secured most of the funds first. - The attacker kept 472,891.80 SMT, 7,826.70 DAI and 3,234.50 USDC, moving SMT to a second address
0x27c317181b3dbf8ca8c3771e47cf7e7fad812512and swapping 427K SMT for about 54 WETH.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
