Digital Asset
Intelligence
Security Incident

BXH Flash Loan Attack

·Historical incident record

Incident Overview

The TokenStakingPoolDelegate contract updated by BXH after the last attack suffered another flash loan attack. The contract lost 40,085 USDT, and the attacker made a profit of 31,794 USDT after paying off the flash loan fee. After analysis, this attack is caused by the use of getReserves() in the contract's getITokenBonusAmount function to obtain the instantaneous quotation, so that the attacker can make a profit by manipulating the quotation.

Sources & References

Original incident referencehttps://www.odaily.news/newsflash/300625 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    BXH

    Attack methodPrivate Key Leakage
    Reported loss$ 2,500,000
  2. Incident date
    Target

    BXH

    Attack methodPrivate Key Leakage
    Reported loss$ 139,195,315
  3. Incident date
    Attack methodUnchecked Input Data
    Reported loss$ 28,900,000
  4. Incident date
    Target

    MEV Bots

    Attack methodContract Vulnerability
    Reported loss$ 1,500,000
  5. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 10,000