Dear KyberSwap Elastic Users,
We regret to inform you that KyberSwap Elastic has experienced a security incident.
As a precautionary measure, we strongly advise all users to promptly withdraw their funds. Our team is diligently investigating the situation, and we…
— Kyber Network (@KyberNetwork) November 22, 2023
However, while it acknowledged the security incident, KyberSwap said the exploit did not impact its aggregator, which was reportedly “operating fully as normal.”
According to Smart Contract and EVM chain audit platform BlockSec, the KyberSwap exploit was “due to tick manipulation and double liquidity counting.” The on-chain security said in a post on X that this was a flash loan attack, with the hacker executing swaps and manipulating prices and ticks of targeted liquidity pools.
“Ultimately, the attacker triggered multiple swap steps and cross tick operations, resulting in double liquidity counting and consequently draining the pools,” BlockSec .
Stolen funds include $20 million in wrapped Ether (wETH), $4 million in Arbitrum (ARB) and $7 million in wrapped Lido-staked Ether (wstETH). The assets are spread across Ethereum, Arbitrum, Optimism, Polygon, and Base.
KyberSwap’s total value locked (TVL) fell sharply after the attack, with data from DeFiLlama showing $13.61 million – down from over $83 million before the exploit. The Kyber Network Crystal (KNC) token was down 3.1% at the time of writing, trading near $0.722.
