KiloEx, a decentralized exchange specializing in perpetual futures trading, recently made headlines after falling victim to a $7.5 million exploit orchestrated by a hacker. In response to this security breach, the KiloEx team took a bold stance by publicly addressing the attacker through a post shared on X. The team issued a stern ultimatum, giving the hacker the option to return 90% of the stolen assets and receive a 10% white hat bounty, or face relentless legal pursuit backed by law enforcement, cybersecurity firms, and exchanges.
The identities and blockchain addresses associated with the attacker were swiftly identified by KiloEx and placed under constant surveillance. Among the exposed wallets were 0x551f3110f12c763d1611d5a63b5f015d1c1a954c, 0x00fac92881556a90fdb19eae9f23640b95b4bcbd, and 0xd43b395efad4877e94e06b980f4ed05367484bf3. The team made it clear that these wallets could be frozen at any moment with the assistance of their partner networks.
To incentivize the hacker to cooperate, KiloEx offered a bounty of 10% of the stolen funds, totaling $750,000, if 90% of the assets were returned within 72 hours to specified wallets across opBNB, BNB Chain, Base, Ethereum, and Manta networks. In the event of compliance, the DEX promised to publicly acknowledge the resolution and close the case without further repercussions.
However, failure to comply would result in the escalation of the matter into a full-scale criminal investigation. The hacker was given the option to contact the team via on-chain messaging or email to initiate a resolution before facing severe consequences.
The exploit that occurred on April 14 was a result of a price Oracle manipulation vulnerability. Security firms such as PeckShield and Cyvers confirmed that the attacker utilized Tornado Cash to fund their wallet and exploited the vulnerability across multiple networks including Base, BNB Chain, and Taiko. By tampering with the asset price data reported to the protocol, the attacker was able to open leveraged positions at significantly skewed valuations, leading to the theft of over $3.1 million in a single transaction.
After discovering the exploit, KiloEx promptly suspended all trading activity and notified partner protocols to blacklist the identified addresses. The team assured the public that the exploit had been contained, and a bounty program was in the works to trace the flow of stolen funds and facilitate recovery wherever possible.
This incident adds KiloEx to the long list of DeFi platforms that have fallen prey to oracle-based attacks. The vulnerability of blockchain oracles, which provide real-world data to smart contracts, has made them an attractive target for exploiters. The UwU Lend attack in June 2024, which saw $19.4 million drained in under six minutes through similar tactics, serves as a stark reminder of the risks associated with DeFi platforms.
As the deadline for the hacker to respond to KiloEx’s ultimatum approaches, the cryptocurrency community eagerly awaits the outcome. Will the hacker choose to cooperate and accept the bounty, or will they face the full force of legal repercussions? Only time will tell how this high-stakes situation will unfold, but one thing is certain – KiloEx is prepared to take decisive action to protect its platform and assets.