Orion Protocol Loses $3M of Crypto in Trading Pool Exploit

Wallets associated with the event are sending ether through mixer Tornado Cash.

AccessTimeIconFeb 2, 2023 at 6:13 p.m. UTC
Updated May 9, 2023 at 4:07 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

Crypto trading venue Orion Protocol was set to pause operations Thursday after an apparent attacker drained millions of dollars worth of cryptocurrency, according to cybersecurity firm Peckshield.

Orion was the victim of a reentrancy attack in which an attacker repeatedly withdraws funds from a smart contract, PeckShield said in a Twitter message. Gal Sagie, CEO of cybersecurity company Hypernative, said the attacker deployed a fake token called ATK which was used to manipulate the Orion pools. It utilized a self-destructing smart contract.

  • Key Events You Shouldn't Miss at Consensus 2024
    Key Events You Shouldn't Miss at Consensus 2024
  • What to Expect From Consensus 2024
    What to Expect From Consensus 2024
  • Will Solana and Altcoins Dominate the Market Next?
    Will Solana and Altcoins Dominate the Market Next?
  • What's Next for FIT21?
    What's Next for FIT21?
  • “The protocol is being paused as we speak,” Peckshield said in a Twitter message. The firm said it is assisting Orion. "The root cause is now confirmed w/ the team and they are fixing the bug now."

    Initial estimates from on-chain sleuths placed the losses at $2.8 million on Orion’s Ethereum implementation and $200,000 on its BSC implementation. A wallet identified as the attacker’s began passing ether tokens through privacy mixer Tornado Cash shortly after the event.

    Orion Protocol CEO, Alexey Koloskov, told investors that "all funds are safe and secure," in a tweet thread in the hours following the attack.

    "We have reasons to believe that the issue was not a result of any shortcomings in our core protocol code, but rather might have been caused by a vulnerability in mixing third-party libraries in one of the smart contracts used by our experimental and private brokers," he said.

    The price of Orion’s native token ORN is little changed following the apparent attack, up nearly 14% in the last 24 hours to $1.03.

    UPDATE (Feb. 3, 08:34 UTC): Adds statement from Orion Protocol CEO starting in third paragraph.


    Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

    CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

    Danny Nelson

    Danny is CoinDesk's Managing Editor for Data & Tokens. He owns BTC, ETH and SOL.

    Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.

    Read more about