Decentralized Exchange KiloEx Falls Victim to a $7M Attack – A Web of Lies and Leverage!

by

What to know:

  • KiloEx, a decentralized exchange, suffered a $7 million loss due to a sophisticated attack exploiting a vulnerability in its price oracle system.
  • The attacker used Tornado Cash to fund a wallet and manipulated asset prices across multiple blockchain networks, including Base, BNB Chain, and Taiko.
  • KiloEx has suspended operations and is collaborating with partners to trace the stolen funds and blacklist the attacker’s wallet.

Ah, the sweet, sweet scent of “rug pulls” in the morning! KiloEx, that charming decentralized exchange (DEX) designed for perpetual futures, found itself on the receiving end of a *very* sophisticated attack just this past Tuesday, resulting in a delightful $7 million loss. Truly, what a way to start the week! 😅

It all unfolded on several blockchain networks, with the tragedy apparently stemming from a tiny little weakness in KiloEx’s price oracle system, according to blockchain detectives over at Cyvers. We all know oracles—those marvelous blockchain-based creatures that tell smart contracts what’s what. They tell us whether Ether is worth $2,000 or $3,000, so that, you know, trades can happen at fair and square prices. Simple, right? Oh, but when they fail… 💥

In this case, some mysterious attacker, whose wallet was funded by Tornado Cash (how convenient, right? 🙄), took advantage of the price oracle’s tiny little vulnerability. Using flash loans (yes, the famous “temporary liquidity” trick), the attacker manipulated asset prices across the Base, BNB Chain, and Taiko networks. A little digital sleight of hand here, a few well-placed transactions there, and boom—$7 million magically disappeared from KiloEx’s vault. 💸💸💸

🚨7M HACK ALERT🚨Our system has detected multiple suspicious transactions involving @KiloEx_perp across several chains.

An address funded via @TornadoCash has executed a series of exploitative transactions on the $BNB, $Base, and $Taiko chains — accumulating approximately $7M in…

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) April 14, 2025

KiloEx, being the responsible adults in the room, promptly confirmed the breach, hit the “pause” button on its platform, and are now scrambling (with partners, no less) to track down the stolen funds and blacklist the attacker’s wallet. Classic. 👀

For those of you who aren’t yet familiar with oracles—think of them as the messengers between the blockchain world and, well, reality. They fetch data from outside the blockchain (like the price of ETH, for example), so smart contracts can make intelligent decisions. Without them, you’re left in a digital void where contracts are making decisions on their own, and it’s pretty clear what happens when that goes wrong, right? 😆

Now, what happened with KiloEx, you ask? The attacker exploited an access control vulnerability in the price oracle system—essentially tricking the system into believing ETH was worth an absurdly low price (let’s say $100 instead of the usual $2,000). This was enough to cause leverage-based chaos, which is just another way of saying, “someone went wild with borrowed money, and no one noticed until it was too late.” 😬

And it worked! They managed to pocket a cool $3.12 million in a single, thrilling transaction. A job well done—if you’re the attacker, of course. 🙃

This, dear reader, is not the first rodeo of its kind. You might recall the likes of Mango Markets in 2022, where $100 million evaporated into thin air, or Cream Finance in 2021, with a jaw-dropping $130 million vanishing just as quickly. It’s almost as if these DeFi platforms are *begging* to be tested by hackers. 🤔

Read More

2025-04-15 10:13