What happened
The attackers' addresses:
The private key of Unlock Founder & CEO was compromised. This key had been used to deploy the Unlock contract on xDAI and Polygon previously and was able to upgrade them.
Ownership was transferred at:
xDAI:
Polygon:
xDAI:
1. 20,000 Tokens were stolen from Unlock contract:
2. Out of the 20,000 tokens that were stolen, 19,980 UDT were transferred by the attacker to the xDAI bridge:
3. Tokens were burnt on xDAI, transferred on Ethereum, and sold on Uniswap:
Polygon:
1. 30,000 tokens were stolen from the Unlock contract:
2. 10,000 UDT were transferred to the Polygon Bridge:
3. The attacker transferred another 20,000 tokens, the token recipient then transferred them to the Polygon Bridge:
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
