Web3 infrastructure provider Ankr Protocol has become the latest platform to fall victim to decentralized finance (DeFi) exploit. The exploit on the BNB chain-based DeFi protocol earlier on 2 December led to the loss of tokens worth several million dollars.
Blockchain analytics firm PeckShield was the first one to shed light on the exploit. Citing data from Etherscan, PeckShield reported that the perpetrator had minted “tons of aBNBc” and sent them to various mixer services.
#PeckShieldAlert Seems like @ankr has been exploited, $aBNBc has dropped -50%, tons of $aBNBc have minted to https://t.co/nyfwdd6fWI
and the exploiter transferred some of the stolen funds to Tornado cash or bridged them via celer and deBridgeGate to Ethereum @peckshield pic.twitter.com/vK94dIEWIt— PeckShieldAlert (@PeckShieldAlert) December 2, 2022
20 trillion aBNBc dumped on PancakeSwap
On-chain analytics outfit Lookonchain later published a detailed report, which revealed that the exploiter minted a whopping 20 trillion aBNBc tokens and dumped them on PancakeSwap.
According to data from Etherscan, the exploited tokens have since been sent to Tornado Cash, Uniswap, 1inch, and various bridges, including Celer bridge and debridge, in order to swap and obscure the trail. The perpetrator netted more than $5 million from this exploit. They also made away with an additional 900 BNB worth almost a quarter million dollars.
A vulnerability in Ankr Protocol’s smart contract is believed to be the reason for this exploit. On-chain experts on Twitter have speculated that compromised private keys may also be responsible for this.
Ankr Protocol responded to the exploit
Through a statement on Twitter, Ankr Protocol informed their community that they had suspended trading while the problem was being worked on. They clarified,
“All underlying assets on Ankr Staking are safe at this time, and all infrastructure services are unaffected.”
Our aBNB token has been exploited, and we are currently working with exchanges to immediately halt trading.
— Ankr (@ankr) December 2, 2022
Furthermore, the Ankr team asked liquidity providers to remove liquidity from decentralized exchanges, while stating that they will re-issue aBNBc. It is interesting to note that the protocol had announced an update to its reward-bearing and earning token models just hours before the exploit.
? We are introducing changes to all Reward Bearing and Earning Tokens token models.
This is a strategic decision that we believe will best serve our community of holders, stakers and liquidity providers ?
For a better understanding, read the ? below.https://t.co/N6RjZOtUYH pic.twitter.com/v7wuQnnx8g
— Ankr (@ankr) December 1, 2022
aBNBc lost over 99% of its value since the news. The token was trading at $303 before the exploit and, at press time, it was worth just $1.50. Ankr Protocol’s native token ANKR also tanked by almost 6%.
