Suspicious Upgrade Drains $4.3M from Alex Bridge on BNB Smart Chain
Crypto News– On May 14, blockchain security platform CertiK reported that the Alex protocol bridge on the BNB Smart Chain network experienced suspicious withdrawals amounting to $4.3 million immediately following a sudden contract upgrade.
Alex, a Bitcoin layer-2 protocol, offers decentralized finance applications on Bitcoin. Its bridges facilitate the transfer of assets from other networks, such as BNB Smart Chain and Ethereum, to the Alex network.
Blockchain data reveals that the Alex deployer account executed five identical upgrades to the Bridge Endpoint contract on the BNB Smart Chain, starting at 3:56 pm UTC. Subsequently, approximately $4.3 million worth of assets, including Binance-Pegged Bitcoin (BTC), USD Coin (USDC), and Sugar Kingdom Odyssey (SKO), were withdrawn from the BNB Smart Chain side of the bridge.
CertiK noted that because the upgrade was conducted by the protocol’s deployer account, the incident might indicate a possible private key compromise.
The upgrade transaction altered the implementation address to one ending in 7058. This new implementation consists of unverified bytecode, rendering it unreadable to human beings.
Suspicious Upgrades Lead to Significant Losses on Alex Bridge
Approximately 48 minutes after the initial upgrades began, the proxy address for the bridge contract called an unverified function on an address ending in 4848E. This resulted in the transfer of 16 BTC ($983,000 at current prices), 2.7 million SKO ($75,000), and $3.3 million worth of USDC at 4:44 pm, into the address ending in 484E.
Potential Cross-Network Exploits
The attacker might be attempting to drain funds from other networks as well. At 5:41 pm, just minutes after the suspicious upgrade on BNB Smart Chain, a similar series of upgrades occurred on Ethereum. The deployer upgraded the artist address to an unverified contract. Immediately afterward, an account ending in 05ed tried to make two withdrawals from the team address. These attempts failed, producing a not owner error.
The 05ed account had no prior history before May 10. It created one unverified contract on May 10 and two more on May 14, suggesting it may be controlled by a malicious user.
Lack of Official Response
As of now, the Alex team has not confirmed the exploit or commented on the incident.
FAQs
What happened to the Alex bridge on the BNB Smart Chain?
The Alex bridge on the BNB Smart Chain suffered a loss of $4.3 million after a suspicious contract upgrade. This upgrade was carried out by the deployer account, which led to significant withdrawals of assets.
Has the Alex team responded to this incident?
As of now, the Alex team has not confirmed the exploit or provided any official comment on the incident.
What assets were affected by this incident?
The affected assets included Binance-Pegged Bitcoin (BTC), USD Coin (USDC), and Sugar Kingdom Odyssey (SKO), which were all removed from the BNB Smart Chain side of the bridge.
For the latest in crypto updates, keep tabs on Crypto Data Space.
Leave a comment