KyberSwap's concentrated liquidity pools were drained of $49M via a sophisticated exploit targeting edge cases in the tick-crossing math.
The attacker identified and exploited a precise mathematical edge case in KyberSwap's concentrated liquidity tick-crossing logic. By carefully constructing swaps that crossed specific tick boundaries in a particular order, the attacker could manipulate the virtual liquidity calculation to extract more tokens than deposited. The exploit required deep mathematical understanding of AMM tick mechanics.
Stolen assets moved through bridges across multiple chains to consolidate on Ethereum. The attacker posted an on-chain ultimatum demanding control of KyberDAO and Kyber's companies in exchange for a 90% fund return. After negotiations failed, funds were routed through Tornado Cash. KyberSwap suspended operations and laid off staff post-hack.
0x485e08fe6b3b6b7e7cd9f8f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4