xToken (2021) — Crypto Hack
LaunderedxToken's xSNX and xBNT pools were exploited via flash loan and reentrancy attack, draining approximately $25M.
Summary
xToken's xSNX and xBNT pools were exploited via flash loan and reentrancy attack, draining approximately $25M.
How It Was Compromised — DeFi via Flash Loan / Reentrancy
The attacker exploited two separate vulnerabilities in xToken's xSNX and xBNT pools. For xSNX, a flash loan was used to manipulate the SNX price oracle during minting. For xBNT, a reentrancy vulnerability allowed the attacker to mint tokens before the balance was updated. Both exploits were executed in coordinated transactions.
Fund Flow & Laundering Analysis
Stolen ETH proceeds moved through Tornado Cash in batches. xToken published a detailed post-mortem and paused all contracts. The protocol was later exploited again in August 2021 for an additional $4.5M. The founding team launched xToken Terminal as a replacement product. No funds recovered.