Binance Smart Chain Protocol Qubit Finance Hacked for $80M

A bug in Qubit’s Ethereum bridge allowed a hacker to siphon 206,809 BNB from its lending pools.

Key Takeaways

A hacker has stolen 206,809 BNB worth $80 million from Qubit Finance.

The hacker exploited a vulnerability on the protocol’s Ethereum bridge.

The Qubit team has offered a bounty of $250,000 to the hacker in return for the stolen funds.

Qubit Finance, a DeFi protocol on Binance Smart Chain, was exploited today for $80 million worth of BNB tokens.

Qubit Hit by Hack

Another Binance Smart Chain protocol has been hacked.

An unknown hacker was able to drain $80 million worth of BNB tokens from the Binance Smart Chain lending protocol Qubit Finance.

On Jan. 27, at around 21:36 UTC, a hacker exploited a vulnerability on the Qubit Bridge, a cross-chain bridge connected to Ethereum. This bridge lets users deposit WETH from Ethereum mainnet into Qubit’s Binance Smart Chain-based smart contract to mint xETH, which can be used as lending collateral on the protocol.

Due to a critical vulnerability in the bridge’s smart contracts, the hacker was able to mint xETH without depositing any WETH, thereby giving them the ability to take out unlimited leveraged loans from Qubit’s pools.

In a Twitter post announcing the exploit, the team reported that the hacker “minted unlimited xETH to borrow on BSC.” Using the xETH as collateral, the hacker proceeded to siphon 206,809 BNB from Qubit Finance, worth about $80 million at the time. The loot can be seen sitting in the hacker’s address.

In an on-chain message directed to the hacker, the Qubit team offered a bounty of $250,000 in return for the stolen funds, as per the protocol’s ongoing bug bounty program with the ethical hacking platform Immunefi. In another post, the Qubit team has also tried to contact the hacker to negotiate.

The Qubit Finance exploit appears to be the seventh-largest DeFi protocol hack in terms of the value of stolen funds, as per data from DeFi Yield. Following the hack, the protocol’s Qubit token has dropped 27% over the past 24 hours.

Since the launch of Binance Smart Chain in September 2020, the chain has become infamous for the amount of hacks, exploits and rug pulls that have taken place on it.

In 2021, several DeFi projects on Binance Smart Chain suffered major hacks or exploits. Some of the most severe include Meerkat Finance’s $31 million hack in March 2021, a Uranium Finance exploit that cost protocol users $50 million in April, and the $88 million attack on Venus Finance in May.

Qubit Finance has not yet commented on plans to reimburse or compensate users for funds lost due to the exploit.

Disclosure: At the time of writing, the author of this piece owned ETH and other cryptocurrencies.

Disclaimer Read More Read Less

The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.

You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.

See full terms and conditions.

Source: cryptobriefing.com