Exactly Protocol Bridge Suffers $7.6 Million Security Breach

Summary

Exactly Protocol on Optimism faced a critical security breach on August 18, resulting in a loss of around $7.6 million. The attackers exploited a vulnerability by manipulating market address inputs, allowing them to bypass key security checks within the protocol. This manipulation granted them unauthorized access to execute a deposit function maliciously, leading to the theft of a substantial amount of USDC from users.

Attackers

The identity of the hackers who attacked Multichain is unknown.

Hacker Optimism Wallets:

• 0x3747dbbcb5c07786a4c59883e473a2e38f571af9
• 0xe4f34a72d7c18b6f666d6ca53fbc3790bc9da042
• 0x417179df13ba3ed138b0a58eaa0c3813430a20e0

Losses

Exactly Protocol estimated the losses from the hack to be $7.6 million. Stollen assets included:

• 5,037,975 USDC
• 1,535 ETH (2,535,820 USD)
• 13,912 OP (21980 USD)
• 8.45 wstETH (16,139 USD)

Timeline

• August 18, 2023, 09:11:33 AM +UTC: The first malicious transaction occurred.
• August 18, 2023, 07:10 PM +UTC: Exactly Protocol reported a security breach and suspended operations.
• August 18, 2023, 08:33:59 PM +UTC: Exactly Protocol team communicated with the hacker, proposing a deal to recover the stolen assets in exchange for a 10% reward, alongside a promise of no legal action.
• August 20, 2023, 11:50 PM +UTC: Exactly Protocol announced the resumption of work.
• August 30, 2023: Exactly Protocol published exploit Post-Mortem.

Security Failure Causes

• Smart Contract Vulnerability: The attack was facilitated by exploiting a smart contract vulnerability that allowed for the manipulation of market address inputs, effectively bypassing the protocol’s critical security checks.