What happened
On May 12, 2021, a single Ethereum transaction exploited xToken's xBNTa and xSNXa minting logic and drained their related Bancor and Balancer liquidity pools. xToken estimated the pool losses at about $25 million, while contemporary reporting placed the figure at $24.5 million. The attacker used flash liquidity to exploit two separate weaknesses: xBNTa accepted a Bancor swap path without confirming that it ended in BNT, and xSNXa derived its mint valuation from a manipulable trade outcome rather than a robust oracle.
Minting was paused after the incident, and xToken later published patched minting logic and a holder distribution plan.
xBNTa trusted an unvalidated user-supplied swap path when determining the asset received for minting. xSNXa valued mints from a spot trade outcome that could be moved within the transaction instead of a manipulation-resistant oracle.
Case & protocol details
Attack Timeline
The transaction combined two minting failures. First, the attacker used temporary liquidity to move the SNX price observed by xSNXa's routed-trade valuation. Because xSNXa calculated its ETH/SNX ratio from the amount of SNX acquired through Kyber rather than a manipulation-resistant price feed, the distorted trade allowed a disproportionate xSNXa mint.
The newly minted tokens were then sold against the Balancer liquidity pool. Second, xBNTa's ETH mint route accepted a caller-provided Bancor trade path but did not verify that the path concluded with BNT. xToken reported that the attacker used a path ending in SPD to spoof the apparent BNT contribution, allowing an unlimited xBNTa mint that was sold into the Bancor xBNTa/BNT pool.
The attacker repaid the flash liquidity in the same transaction; it supplied scale and atomic settlement, while the underlying faults were unvalidated routing input and manipulable mint valuation.
Evidence & learning
Sources and on-chain records
- report Report twitter.com
- report Post-mortem medium.com
- report Post-mortem rekt.news
- report Post-mortem medium.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.