Qubit Finance Hack 2022 — $80M Exploit Analysis

Qubit's QBridge exploit allowed minting of unlimited xETH collateral by depositing zero ETH on Ethereum via a logic error.

Details

• Date: 2022-01-27
• Amount Lost: $80,000,000
• Chain(s): BSC, Ethereum
• Category: Bridge
• Technique: Smart Contract Exploit
• Status: Laundered
• Amount Recovered: None reported

Full Description

Qubit Finance's QBridge contract contained a critical vulnerability allowing attackers to call the deposit() function with zero ETH and still receive xETH tokens on BSC as collateral. The attacker then used this collateral to borrow all available assets from QBridge's liquidity pools. The bug stemmed from failing to check for zero-value deposits.

Laundering Analysis

206,809 BNB quickly dispersed across multiple BSC wallets. Qubit team published an on-chain message requesting fund return with a $250K bounty offer. Attackers never responded. Funds subsequently routed through cross-chain bridges and exchanged for stablecoins on multiple DEXes.

Sources

• https://medium.com/@QubitFin/qubit-bridge-hack-post-mortem-a70a1c0cb6b1
• https://rekt.news/qubit-rekt/

Transaction Hashes

• 0xa6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b

Related Hacks

• Ronin Network (Axie Infinity) — 2022-03-23 — $625M
• Poly Network — 2021-08-10 — $611M
• BNB Chain Bridge (BSC Token Hub) — 2022-10-07 — $570M
• Wormhole — 2022-02-02 — $320M
• Mixin Network — 2023-09-23 — $200M

Back to Browse