unshETH Hack

UnshETH suffered an access control exploit resulting in the loss of $375,000 $USD worth of farm rewards and protocol liquidity

UnshETH is a staking and yield protocol in Ethereum and Arbitrum chains. One of the deployer keys for auxiliary unshETH contracts (farms and bridge contracts) was compromised. The security teams narrowed down the scope of impact to USH farm rewards and protocol-owned liquidity.

Onchain message communication with the malicious actor was established for recovery purposes. Within two hours after being contacted by unshETH team members, the attacker responded with intentions to return control of all compromised contracts which were then transferred back to multisig addresses on each chain securing all impacted assets. The attacker had already recovered some assets and gained approximately 375,000 $USD in proceeds but negotiations are ongoing towards their retrieval in exchange for a 50,000 $DAI as a whitehat bounty.

During this incident, unshETH withdrawals were paused for 24 hours.

Malicious transaction:

https://etherscan.io/tx/0x2cf0c07d…3439d2

Onchain messages:

https://etherscan.io/tx/0x6b7d74b8…8565c3

https://etherscan.io/tx/0x7faade0b…09b37a