TechFlow news, April 21 — KiloEx released a root cause analysis and post-mortem report regarding the hacking incident. The incident originated from its smart contract's TrustedForwarder contract, which inherited OpenZeppelin's MinimalForwarderUpgradeable but failed to override the execute method, allowing the function to be arbitrarily called.
The attack occurred between April 14, 18:52 and 19:40 UTC. The hacker deployed malicious contracts across multiple chains including opBNB, Base, BSC, Taiko, B2, and Manta to carry out the attack. After negotiation, the hacker agreed to keep a 10% bounty and has returned all stolen assets—including USDT, USDC, ETH, BNB, WBTC, and DAI—to KiloEx’s designated multi-signature wallet.
Add to Favorites
Share to Social Media
