Digital Asset
Intelligence
Security Incident

xToken Oracle Attack: $25.00M Reported Loss

·Historical incident record

Incident Overview

The DeFi pledge and liquidity strategy platform xToken was attacked, and the xBNTaBancor pool and the xSNXaBalancer pool were immediately exhausted, causing nearly $25 million in losses. The SlowMist security team analyzed that the two modules that were hacked this time were the xBNTa contract and the xSNXa contract in xToken. The two contracts were subjected to a "counterfeit currency" attack and an oracle manipulation attack.

Sources & References

Original incident referencehttps://twitter.com/FrankResearcher/status/1392515198674681863 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    xToken

    Attack methodFlash loan attack
    Reported loss$ 4,500,000
  2. Incident date
    Target

    flash.sx

    Attack methodReentrancy Attack
    Reported loss$ 11,742,000
  3. Incident date
    Attack methodContract Vulnerability
    Reported loss$ 14,000,000
  4. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 10,000
  5. Incident date
    Target

    $TENDRIL

    Attack methodSmart Contract Vulnerability
    Reported loss$ 555000