What happened
On June 1, 2023, unshETH's unshiETH Farm was drained after the project leaked a private key to GitHub. CertiK estimates the loss at about $375,000 and says the incident was outside the scope of its prior audit.
How it happened
- A private key with authority over the unshiETH Farm was exposed in a public GitHub repository.
- The attacker used the leaked key to authorize withdrawals from the farm.
- Assets valued by CertiK at about $375,000 were removed before the incident was contained.
Protocol details
Classification
Yield Aggregator / Frontend & Infrastructure
Protocol Type
Indexes
Affected asset / contract
unshETH
Implementation language
Solidity
Protocol links
Website
@unsheth_xyz
Security review history
- CertiK View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
