The decentralized-finance protocol announced that it is working with exchanges to stop trading its BNB staking rewards coin, aBNBc, immediately.
A multimillion-dollar exploit was used against the BNB Chain-based decentralized finance (Defi) system Ankr on December 1.
PeckShield, an on-chain security analyst, appears to have spotted the attack for the first time at 12:35 UTC on December 2.
Ankr tweeted an hour after the hack to clarify that the aBNB token had been abused and that it was working with exchanges to stop trading the compromised token.
The Ankr Reward Bearing Staked BNB
A reward-bearing token for BNB staked on the protocol, called Ankr Reward Bearing Staked BNB (aBNBc), is said to have been minted by the attacker in the amount of 20 trillion.
The exploiter allegedly used services like Uniswap, Tornado Cash, and several bridges to swap and conceal the funds to earn about $5 million worth of USD Coin, according to a tweet from on-chain analysis company Lookonchain. In a subsequent statement, it also stated that
“all underlying assets on Ankr Staking are safe at this time, and all infrastructure services are unaffected.
The Technical Improvement
Blockchain security company Beosin commented on the hack and said that the exploit was probably caused by flaws in the smart contract code and stolen private keys, which may have resulted from a recent technical upgrade by the Ankr team.
According to CoinMarketCap data, the mass minting episode led the price of aBNBc to plunge 99.5% in a couple of hours, from $303.89 to $1.53.
“It is possible that the deployer’s private key was exposed in this upgrade, leading to an attacker using deployer privileges to modify the contract,” said Beosin spokesman
The cryptocurrency exchange Binance confirmed in a tweet on December 2 that its team is working with relevant parties to look into the situation further and that its users’ funds are safe. Additionally, the exploiter’s wallet address has been blacklisted, according to the BNB Chain Twitter page.
