OKX DEX suffers $2.7M exploit after proxy admin contract upgrade

 

An attack on the OKX DEX caused a loss of almost $2.7 million in cryptocurrency when a proxy admin updated a contract, giving a hacker access to the private key.

On December 13, the $2.7 million hack of the OKX decentralized exchange (DEX) occurred as a result of a purported leak of the proxy admin owner's private key. 

The blockchain security company SlowMist Zone announced that OKX DEX "encountered an issue" on X, formerly Twitter, on December 13. The study states that the incident started on December 12, 2023, at roughly 10:23 p.m. UTC, when the user started stealing tokens and the proxy admin owner upgraded the DEX proxy contract to a new implementation contract.

🚨SlowMist Security Alert: OKX DEX Proxy Admin Owner's Private Key Suspected to be Leaked🚨

According to information from SlowMist Zone, the OKX DEX contract appears to have encountered an issue. After SlowMist's analysis, it was found that when users exchange, they authorize…

— SlowMist (@SlowMist_Team) December 13, 2023

 After that, at around 11:53 p.m. UTC, the proxy admin owner updated the contract once more, and the user carried on abusing tokens. According to SlowMist's investigation at the time, the attack "may" have been caused by the proxy admin owner's key being compromised. After that, the DEX proxy was taken off the trusted list of the platform.

The attack was also noticed by the on-chain analysis company Scopescan, which stated that users were reporting the incident. It stated that it was informed by the DEX that an old, abandoned contract had been attacked, but that it had been found and stopped. Furthermore, the OKX DEX stated that any user damages resulting from the attack will be "completely borne

Users reported an exploit event on the #OKX DEX contract.

We have contacted them and got the following response:

"The old abandoned MM contract was attacked, and the attack has been located and stopped.

The losses of the users involved will be fully borne."

Exploiters… https://t.co/psuz4WcjGl pic.twitter.com/GrKUdrnGVk

— Scopescan (@0xScopescan) December 13, 2023

 A report from PeckShield, a blockchain security business, claims that the OKX DEX hack cost almost $2.7 million in total in different cryptocurrencies. Users were urged by PeckShield to "please revoke allowances" if any exist. 

A reminder was posted by one X user in light of the attack, stating that assets are not always safe merely because something is "decentralized": 

People say they want decentralization, so builders give them DEXs.

Just because its decentralized, folks think we won't lose our assets. No you are wrong, you can still get hacked, and today's unfort episode with OKX DEX is a reminder of "be careful of what you wish for".

— Eugene Ng 🌊 (I’m Hiring) (@Eug_Ng) December 13, 2023

 According to a study, the cryptocurrency business lost $1.5 billion this year as a result of breaches, exploits, and scams up until September 2023. So far in the fourth quarter, Poloniex has experienced an exploit that has cost them over $100 million in lost digital assets, while the HECO Chain bridge hack has resulted in damages over $80 million. Coinelegraph inquired with OKX for more details regarding the previously described exploit.