Decentralized finance (DeFi) protocol bZx has fallen victim to yet another attack after a bug in its code allowed someone to mint tokens they redeemed for cryptocurrencies on the protocol.
- Co-founder Kyle Kistner told CoinDesk the company noticed something was wrong on Sunday when a single LINK withdrawal led to a $2.6 million drop in the protocol's total value locked (TVL).
- The attack basically centered around the protocol's interest-earning iToken that users receive and redeem for crypto deposited into lending pools.
- Kistner said the attacker exploited a bug that tricked bZx into minting unbacked iTokens subsequently exchanged for cryptocurrencies held in the pools.
- At current spot prices, this works out as a loss of just over $8 million.
- bZx paused the protocol in the aftermath of Sunday's attack so the bug could be patched, and resumed operations hours later.
- Kistner said the decision was taken in consultation with security experts, who had not instructed the company to shut down for any longer.
- He added the $8 million lost had already been debited by the protocol's insurance fund and will be paid out once the bZx community had ratified it.
- The bug managed to remain undetected in two extensive code audits from cybersecurity firms Certik and Peckshield.
- Kistner declined to comment on the identity of the hacker.
CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk offers all employees above a certain salary threshold, including journalists, stock options in the Bullish group as part of their compensation.