Crypto News Today- Alex bridge on BNB Smart Chain Loses $4.3M After Suspicious Upgrade

Suspicious Upgrade Drains $4.3M from Alex Bridge on BNB Smart Chain

Crypto News– On May 14, blockchain security platform CertiK reported that the Alex protocol bridge on the BNB Smart Chain network experienced suspicious withdrawals amounting to $4.3 million immediately following a sudden contract upgrade.

Alex, a Bitcoin layer-2 protocol, offers decentralized finance applications on Bitcoin. Its bridges facilitate the transfer of assets from other networks, such as BNB Smart Chain and Ethereum, to the Alex network.

Blockchain data reveals that the Alex deployer account executed five identical upgrades to the Bridge Endpoint contract on the BNB Smart Chain, starting at 3:56 pm UTC. Subsequently, approximately $4.3 million worth of assets, including Binance-Pegged Bitcoin (BTC), USD Coin (USDC), and Sugar Kingdom Odyssey (SKO), were withdrawn from the BNB Smart Chain side of the bridge.

CertiK noted that because the upgrade was conducted by the protocol’s deployer account, the incident might indicate a possible private key compromise.

The upgrade transaction altered the implementation address to one ending in 7058. This new implementation consists of unverified bytecode, rendering it unreadable to human beings.

Suspicious Upgrades Lead to Significant Losses on Alex Bridge

Approximately 48 minutes after the initial upgrades began, the proxy address for the bridge contract called an unverified function on an address ending in 4848E. This resulted in the transfer of 16 BTC ($983,000 at current prices), 2.7 million SKO ($75,000), and $3.3 million worth of USDC at 4:44 pm, into the address ending in 484E.

Potential Cross-Network Exploits

The attacker might be attempting to drain funds from other networks as well. At 5:41 pm, just minutes after the suspicious upgrade on BNB Smart Chain, a similar series of upgrades occurred on Ethereum. The deployer upgraded the artist address to an unverified contract. Immediately afterward, an account ending in 05ed tried to make two withdrawals from the team address. These attempts failed, producing a not owner error.

The 05ed account had no prior history before May 10. It created one unverified contract on May 10 and two more on May 14, suggesting it may be controlled by a malicious user.

Lack of Official Response

As of now, the Alex team has not confirmed the exploit or commented on the incident.

FAQs

For the latest in crypto updates, keep tabs on Crypto Data Space.