Atlantis Loans Hack

Atlantis Loans was a lending protocol on BNB Chain, with a second deployment on Polygon. Its team abandoned the project in early April 2023, saying it could no longer afford to maintain it. Because the protocol could only be changed through governance votes, and hardly anyone was still paying attention, an attacker was able to push through a malicious proposal on their own. A first attempt in April failed, but a second one passed and was carried out on 10 June 2023, replacing several of the protocol's contracts with versions that contained a backdoor.

Since the project had been abandoned, there were no user deposits left in the protocol itself. But many former users still had active approvals to the Atlantis Loans contracts, and the backdoor let the attacker use those approvals to take tokens straight out of their wallets. Early reports put the losses at around $1M, but the total grew to over $2.5M as more drains came to light. About a month later, in July 2023, the same attack was repeated against the Polygon deployment of Atlantis Loans.

Nobody is left to maintain Atlantis Loans, so the backdoored contracts on BNB Chain and Polygon will not be repaired. Anyone who used Atlantis Loans in the past and still has approvals to its contracts remains at risk, so check your wallet on both chains and revoke any approvals that are left. The attack is also a reminder that approvals do not expire when a project shuts down, so it is worth revoking approvals for apps you no longer use.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.