Qubit Finance was hacked – $80 million gone

28/01/2022
DeFi, Altcoins, News

$80 million worth of cryptocurrency was stolen from the Qubit Finance platform. She thus joins the growing list of DeFi projects that have been damaged by criminal hackers. The attacker exploited a vulnerability to mint xETH tokens, which were then exchanged for Binance coins, from which 200,000 were then withdrawn. The platform says it is trying to track the attacker and is working with network and security partners.

Qubit Finance shared on Twitter that the hacker minted a certain amount of xETH, which he used to borrow via the Binance Smart Chain protocol.

The protocol was exploited by;
0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
The hacker minted unlimited xETH to borrow on BSC.
The team is currently working with security and network partners on next steps.
We will share further updates when available.
— Qubit Finance (@QubitFin) January 28, 2022

In a more detailed report, the platform said the attacker was targeting their QBridge deposit feature. According to PeckShield , a blockchain security company :

“It appears that QubitFin’s QBridge was hacked to mint a huge amount of xETH collateral and drained the pooled fund of $80 million. Please note that we audited Qubit Lending, not QBridge!”

The attacker stole 206,809 Binance Coin tokens worth $79.7 million, on-chain data from BscScan shows.

Regarding the actions taken, Qubit said it was tracking the attacker and monitoring the affected assets. Also, Qubit has contacted the attacker and offered him the maximum bounty if he returns the stolen money. This behavior is common practice: if DeFi platforms are unable to enforce other measures, they talk to the attackers. Surprisingly, this has worked in the past – prompting speculation as to the motives of the attackers.

Update:
1. The team continues to track the exploiter and monitor affected assets
2. The team has contacted the exploiter to offer the maximum bounty
— Qubit Finance (@QubitFin) January 28, 2022

In its on-chain message to the attacker, Qubit said it hopes to minimize the impact on the community:

In another message, Qubit addressed the attacker and stated:

“We suggest you negotiate with us directly before taking any further steps. The exploit and loss of funds has had a profound impact on thousands of people. If max bounty isn’t what you’re looking for, we’re open to a conversation. Let’s find a solution.”

Qubit is a DeFi protocol that allows its customers to borrow against crypto collateral at a fixed rate. The $80 million now gone is the seventh-highest amount lost in a DeFi hack. Its native token, QBT, is down 27% since the attack, trading at $0.00459207 at press time.