xPet Hack

xPET, a Social Fi and Game Fi platform on Arbitrum, was exploited due to a smart contract vulnerability, resulting in a loss of 91.5 ETH worth 256,570 USD.

On February 16, 2024, xPET's on-chain PvP contract was exploited, allowing the attacker to withdraw a large amount of $BPET tokens. The vulnerability was related to the newly launched PvP feature. The attacker dumped over 1 million BPET tokens to obtain 91.5 ETH, which was then transferred to another EOAs and bridged to the Ethereum chain via Across Protocol.

The CEO of xPET, @Michaeltalkhere posted on X account that how they got the money back.The attacker returned all part of the stolen funds in two transactions on Feb 17,2024.

Attacker Address:

Address 0x2251…9f31

Funds Holder as of Feb 17, 2024:

Address 0x0671…B6e1

Malicious Transactions:

Tx 0x058b…dec6

Tx 0x1ad1…ef53

Funds Returned Transactions:

Tx 0x825e…41ee

Tx 0xaeb7…2573

Bridged Transaction via Across Protocol:

Tx 0x4323…76bf

CEO's post on X about stolen funds reward:

Source