Biswap v3 Migrator Hack

Biswap is a decentralized exchange on BNB Chain. When it launched version 3 of its exchange, it also released migrator contracts to help liquidity providers move their funds from v2 to v3 in a single step. To use the migrator, users approved it to move their v2 LP tokens, which represent their share of a liquidity pool. On 30 June 2023, attackers discovered that the migrator did not properly check the details it was given. By feeding it fake tokens, they could use other users' approvals to pull out the real assets behind their LP tokens.

The attack drained about $865k from liquidity providers on BNB Chain. Security firm Beosin raised the alarm while the attack was still ongoing, and Biswap urged users to revoke their approvals to the migrator contracts as soon as possible. The attacker swapped stolen assets for BNB and laundered part of it through the Tornado Cash mixer. Biswap said it took full responsibility for users' funds and fully compensated affected users in July 2023.

Affected users were reimbursed, but the vulnerable migrator contracts are still deployed on BNB Chain, so any approvals that remain could still be abused. Biswap's advice to revoke approvals to them still stands: if you ever used the Biswap v3 migrator, check your wallet and revoke any approvals you gave it. Revoking these approvals does not affect your other positions on Biswap.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.