What happened
On November 20, 2021, an attacker drained the WBNB side of the wZNN/WBNB liquidity pool on BNB Smart Chain. The cause was a burn() function in the wrapped ZNN (wZNN) contract that was marked external without an access check, so anyone could call it. Halborn put the loss at about $1 million in BNB. The exploit transaction was 0xc14ae484b49a346fca9bb414e302c6a9ad0e16fc085c8e197ac7ae85df5727fc, and the attacker address reported at the time was 0x53d4307d7cc1e1b728c0678618efe10a339c18fd.
Zenon said only the BSC liquidity pool was affected. Its legacy network and wZNN held outside the pool were not touched. The team halted the BSC bridge, sent the attacker an on-chain message asking for the funds back in exchange for a bounty, and on November 23 announced a restored wZNN contract at 0x84b174628911896a3b87fa6980d05dbc2ee74836. It said it would announce a compensation plan for liquidity providers.
How it happened
- Using flash-loaned funds, the attacker put tokens into the pool to get wZNN.
- The attacker called the unprotected
burn()function and destroyed over 26,000 wZNN from the pool. - With far less wZNN in the pool, each remaining wZNN was priced at a much higher WBNB value.
- The attacker swapped their wZNN back at that inflated rate and drained the pool's WBNB.
Protocol details
Evidence
- report @Zenon_Network incident report twitter.com
- report Report halborn.com
- report twitter.com page 146216…2784 twitter.com
- transaction bscscan.com transaction 0xc14a…27fc bscscan.com
- address bscscan.com address 0x53d4…18fd bscscan.com
- analysis Explained: The Zenon Network Hack (November 2021) halborn.com
- analysis Zenon Announcements (Telegram channel archive, posts 143-152) t.me
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
