In a targeted exploit, decentralized exchange (DEX) aggregator and liquidity protocol KyberSwap, which serves as the main protocol in the Kyber Network’s liquidity hub, suffered a significant security breach.
On November 23, 2023, KyberSwap was attacked, resulting in the theft of approximately $54.7 million, according to intelligence provided by the SlowMist Security Team. Now, more than seven days after the initial attack, the hacker has issued bold and audacious demands.
Critical Vulnerability In Liquidity Management System
The attack involved a series of meticulously planned steps. The attacker began by borrowing 2000 Wrapped Ether (WETH) through a flash loan from the AAVE protocol.
With 6.8496 WETH, the attacker conducted a swap for frax Ether (frxETH) in the KyberSwap pool, intentionally causing the frxETH price to exceed the range of all liquidity providers’ positions.
Subsequently, the attacker added liquidity of 0.006948 frxETH and 0.1078 WETH within a specified price range. Manipulating the liquidity amount within this range to be 74692747583654757908, the attacker strategically controlled the liquidity to align with their subsequent attack stages.
The attacker then utilized 387.17 WETH to swap for 0.005789 frxETH, significantly increasing the current price value. Finally, the attacker performed a reverse swap,…
