DeFi Project bZx Exploited for Second Time in a Week, Loses $630K in Ether

Bad actors have made off with $630,000-worth of the ether (ETH) cryptocurrency after exploiting a price feed of the ethereum-based lending project bZx.

The attack – the second in less than a week – began at just after 03:00 UTC Tuesday, when attackers apparently took out a flash loan of 7,500 ETH (approximately $1.98 million), using 3,518 ETH (~$939,300) to purchase synthetic USD stablecoin sUSD from the issuer that they then posted as collateral for a bZx loan, according to an analyst on Twitter.

They then used 900 ETH (~$240,000) to bid up the value of sUSD through an integrated price feed from liquidity provider Kyber Network until the dollar stablecoin spiked at $2. Using this inflated collateral, they then took out another loan of 6,796 ETH (roughly $1.8 million) which they used to pay back the original 7,500 ETH loan, pocketing the remaining 2,378 ETH.

The total amount stolen is worth approximately $633,000, according to CoinDesk’s Ether Price Index. In its entirety, the attack took just over a minute from beginning to end. The exploiters have left an open loan with half the required collateral now sUSD has returned to its dollar-pegging.

The total amount of ether locked in bZx lending contracts has nearly halved from 40,000 ETH (~$10.7 million) to 23,000 ETH (~$6.1 million) since the exploit took place, according to statistics site DeFi Pulse.

The official Twitter account for bZx confirmed at 04:38 UTC the project had suspended trading after it detected “suspicious transactions using flash loans and trading on Synthetix.” A bZx spokesperson confirmed on the group’s Telegram channel that the company itself, rather than any of the platform’s users, would cover the shortfall.

The attack comes days after bZx fell victim to a similar flash loan-based attack that saw more than $350,000-worth of cryptocurrencies extracted from the platform. It’s unclear whether the two attacks were carried out by the same person or group.

The vast majority of DeFi lending facilities rely on overcollateralized loans: borrowers can usually only borrow around 75 percent of the value of their collateral. Although that incentivizes users to pay back loans, it also requires lenders to have very high liquidity – sometimes in a diverse range of assets – in order to quickly liquidate loans.

Flash loans are instruments that allow traders to liquidate the loans on the lender’s behalf. It works by having the trader take a loan out from the lender – this time not posting any collateral – paying back the borrower’s debt and collecting the deposit. Using the deposit, they can then pay back the original loan and pocket the remaining funds.

Flash loans were already available on other DeFi projects such as the non-custodial lending platform Aave Protocol, which has offered them since the beginning of the year.

bZx only launched its own flash loan instruments on Monday. CEO Tom Bean has defended the decision to introduce flash loans onto the platform. “By all accounts, the flash loan code on bZx was not what allowed this attack. It was just a tool used that functioned correctly and could have been swapped out for dydx and Aave flash loans,” he wrote on the company’s Telegram channel.

Kyle Kistner, bZx’s chief visionary officer and operations lead confirmed, also on Telegram, that the flash loan hack was “completely tractable.” He also highlighted that bZx would accelerate plans to integrate Chainlink to diversify price feeds and prevent oracle manipulations from happening again.

A representative for bZx told CoinDesk the team was trying to resolve the exploit with its team of engineers. CoinDesk has approached both Bean and Kistner for comment and will update the article should we hear back.