{"id":66612,"date":"2022-09-02T10:32:20","date_gmt":"2022-09-02T07:32:20","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=66612"},"modified":"2025-09-07T02:14:39","modified_gmt":"2025-09-06T23:14:39","slug":"unknown-attackers-hack-kyberswap-frontend","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/unknown-attackers-hack-kyberswap-frontend\/","title":{"rendered":"Unknown attackers hack KyberSwap frontend"},"content":{"rendered":"<p>Hackers breached the front end of the non-custodial KyberSwap DeFi project Kyber Network. User losses amounted to 265,000 <a href=\"https:\/\/forklog.com\/en\/news\/what-is-the-usdc-stablecoin\">USDC<\/a>.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\">1\/ \u2757\ufe0fNotice of Exploit of KyberSwap Frontend:<\/p>\n<p>We identified and neutralized an exploit on the KyberSwap frontend. Affected users will be compensated. We have summarized the details in this thread\u2b07\ufe0f<\/p>\n<p>\u2014 Kyber Network (@KyberNetwork) <a href=\"https:\/\/twitter.com\/KyberNetwork\/status\/1565421305410686976?ref_src=twsrc%5Etfw\">September 1, 2022<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>On September 1, the KyberSwap developers detected suspicious activity at the front end. After closing the interface to conduct an investigation, they found malicious code in the <span data-descr=\"Google Tag Manager\" class=\"old_tooltip\">Google Tag Manager<\/span> tool (GTM).<\/p>\n<p>The exploit injected a fraudulent transaction approval, enabling the attackers to drain user funds to their own addresses.<\/p>\n<p>The team relaunched the interface in under two hours, removing the malicious code from GTM.<\/p>\n<p>The attack affected two addresses. The developers assured that those affected would receive full compensation. They believed the attackers were targeting whale wallets.<\/p>\n<p>The KyberSwap team identified the hackers\u2019 addresses on the Ethereum and Polygon networks, and reached out to various exchanges to track and block the movement of the stolen assets.<\/p>\n<p>According to PeckShield, the initial funds for the attack were withdrawn by the attackers from the centralized BitMart platform.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> <a href=\"https:\/\/twitter.com\/KyberNetwork?ref_src=twsrc%5Etfw\">@KyberNetwork<\/a> suffered a frontend exploit, ~265k <a href=\"https:\/\/twitter.com\/search?q=%24amUSDC&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$amUSDC<\/a> were taken from 0x20fc\u2026dc. It revoked the approval.<br \/>The stolen funds currently mainly sit in 0xfd6F29\u202665<br \/>PeckShield has detected the initial funds of the exploit are withdrawn from <a href=\"https:\/\/twitter.com\/BitMartExchange?ref_src=twsrc%5Etfw\">@BitMartExchange<\/a> <a href=\"https:\/\/t.co\/YnsKnafoUw\">https:\/\/t.co\/YnsKnafoUw<\/a> <a href=\"https:\/\/t.co\/BkTzQgnWiO\">pic.twitter.com\/BkTzQgnWiO<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1565545261547814912?ref_src=twsrc%5Etfw\">September 2, 2022<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>KyberSwap offered the hackers a route to contact them and return the stolen funds for a bounty equal to 15% of the amount.<\/p>\n<div class=\"wp-block-text-wrappers-update-2 article_update\"><time class=\"gtb_text-wrappers_update_time\">3 September 2022 | 16:56<\/time><span class=\"gtb_text-wrappers_update_head\">Update: <\/span><\/p>\n<p>Binance CEO Changpeng Zhao said that the security team of the Bitcoin exchange identified two suspects in the hack and passed the information to KyberSwap&#8217;s team. The company is now coordinating its actions with law enforcement.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Binance?src=hash&#038;ref_src=twsrc%5Etfw\">#Binance<\/a> security team has identified two suspects for yesterday&#8217;s KyberSwap hack. We have provided the intel to the Kyber team, and are coordinating with LE (law enforcement).<\/p>\n<p>Stay <a href=\"https:\/\/twitter.com\/hashtag\/SAFU?src=hash&#038;ref_src=twsrc%5Etfw\">#SAFU<\/a>. <a href=\"https:\/\/t.co\/tbQBGaGTNG\">https:\/\/t.co\/tbQBGaGTNG<\/a><\/p>\n<p>\u2014 CZ \ud83d\udd36 BNB (@cz_binance) <a href=\"https:\/\/twitter.com\/cz_binance\/status\/1565976776710430721?ref_src=twsrc%5Etfw\">September 3, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div>\n<\/figure>\n<\/div>\n<p>According to Dune Analytics, the platform sits 18th in the weekly DEX volume ranking, with $2.57 million. The leader is Uniswap, with $8.8 billion.<\/p>\n<p>Earlier in August, the FBI <a href=\"https:\/\/forklog.com\/en\/news\/fbi-identifies-popular-attack-vectors-targeting-the-defi-sector\">issued a warning<\/a> about the most common vulnerabilities used by cybercriminals to attack DeFi platforms.<\/p>\n<p>Read ForkLog&#8217;s bitcoin news on our <a href=\"https:\/\/telegram.me\/forklog\" target=\"_blank\" rel=\"nofollow noopener\">Telegram<\/a> \u2014 news on cryptocurrencies, prices and analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers breached the front end of the non-custodial KyberSwap DeFi project Kyber Network. User losses amounted to 265,000 USDC.<\/p>\n","protected":false},"author":1,"featured_media":66613,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,1416],"class_list":["post-66612","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-kyber-network"],"aioseo_notices":[],"amp_enabled":true,"views":"27","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/66612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=66612"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/66612\/revisions"}],"predecessor-version":[{"id":66614,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/66612\/revisions\/66614"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/66613"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=66612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=66612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=66612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}