Another huge Defi-Exploit, Ankr protocol attacked for 10 trillion aBNBc tokens

In a shocking turn of events, the Ankr aBNBc contract was recently attacked, resulting in the creation of an additional 10 trillion aBNBc tokens. This is particularly concerning because BNB Chain had recently launched the liquid staking feature, which allowed users to earn interest by staking their BNB tokens to the liquid staking agreement and receiving aBNBc tokens in return. The attack happened in the following transaction: https://bscscan.com/address/0xf3a465c9fa6663ff50794c698f600faa4b05c777

Quick Summary:

  1. Ankr aBNBc contract was attacked, resulting in the creation of 10 trillion additional aBNBc tokens.
  2. Ankr announced they would purchase 5 million BNB worth of tokens to compensate the liquidity providers.
  3. Tornado Cash is being used to launder the stolen funds
  4. Ankr had previously received an Audit from Peckshield warning about a “trust issue of Admin Keys”, which had the potential to be used for privileged minting of aBNB tokens.
  5. Companies must take security warnings seriously and address any potential vulnerabilities as soon as possible to avoid catastrophic financial losses and reputational damage.

What is the Ankr Platform

Ankr is a blockchain-based cross-chain infrastructure with a DeFi platform that enables staking and dApp development, and was designed and developed with the goal of creating a decentralized, private, and secure internet. Through the Stkr protocol, users are able to stake Ethereum (ETH) in return for aETH, which represents the future gains on their deposited staking balance. With their mainnet launched in 2019, users can deploy development nodes and build dApps on the network, or deploy staking nodes and become stakers on the ANKR Web3 platform.

What happened with the exploit

The Ankr Exploiter was able to transfer 900 BNB into Tornado Cash, which caused the price of aBNBc to drop by 99.5%. In response to this security breach, Ankr announced that they would purchase 5 million BNB worth of tokens and use them to compensate the liquidity providers. Additionally, they plan to take a snapshot and reissue ankrBNB to all valid aBNBc holders before the exploit.

Ankr’s response to the incident

Tornado Cash is an Ethereum-based noncustodial privacy platform that provides users with the ability to deposit and withdraw ERC-20 tokens and ETH without revealing the source of the funds. A secret hash is generated by the protocol whenever a user deposits funds into the liquidity pools and this hash is used to prove ownership when they wish to withdraw. This ensures that the source of the funds is untraceable, providing total asset privacy. In 2020, ownership of Tornado Cash was transferred to its community, making it a fully decentralized protocol. As such, no one individual or entity has control over it, thereby ensuring that users can use the protocol in complete confidence that their privacy is secure.

Damage will be minimal as Ankr is willing to compensate for damages

This incident serves as a reminder that having an audit does not guarantee security. Ankr had previously received an Audit from Peckshield warning about the ‘trust issue of Admin Keys’, which had the potential to be used for privileged minting of aBNB tokens. Despite this warning, the team “Confirmed” the warning but failed to address the underlying issue.

As this incident demonstrates, it is essential that companies take security warnings seriously and address any potential vulnerabilities as soon as possible. Without proper security measures in place, companies risk potentially catastrophic financial losses and reputational damage. It is therefore important that companies regularly review their security protocols and remain vigilant against possible threats.

The information provided in this article is intended for general guidance and information purposes only. Contents of this article are under no circumstances intended to be considered as investment, business, legal or tax advice. We do not accept any responsibility for individual decisions made based on this article and we strongly encourage you to do your own research before taking any action. Although best efforts are made to ensure that all information provided herein is accurate and up to date, omissions, errors, or mistakes may occur. 
Disclosure: Authors are invested in cryptocurrency projects and have cryptocurrency holdings - including those covered on this website. 

Max Maiboroda
Max Maiboroda
Max is passionate about two things - cryptocurrency and adventure. When he's not Frantically trading, he's enjoying live on a random Thai Beach.

Stay Connected

15,500FollowersFollow
156,666FollowersFollow
268,000SubscribersSubscribe

Latest Articles