BitKeep Swap Hack

BitKeep is a multi-chain crypto wallet with a built-in swap feature called BitKeep Swap, and it has since been renamed Bitget Wallet. To swap tokens in the app, users approved BitKeep's swap contracts to spend their tokens, often without any limit. On 17 October 2022, an attacker found a weakness in these contracts on BNB Chain and Polygon that let them make swaps on behalf of wallets that had given such approvals. They used it to pull tokens out of those wallets without the owners' permission.

Over roughly three and a half hours, the attacker took tokens worth about $1.1M and moved part of the proceeds through Tornado Cash. BitKeep then paused BitKeep Swap to stop the attack and promised to cover all user losses. It opened a claim portal where affected users were paid back in USDT, based on the price at which the hacker had sold their tokens, usually within 24 hours of filing a claim. BitKeep also added a feature to the wallet that checks for risky swap approvals.

Because BitKeep offered to cover the losses in full, users who filed a claim were paid back. Even so, approvals given to the old BitKeep Swap contracts on BNB Chain and Polygon stay active in any wallet that never removed them. At the time, security firm PeckShield advised users to revoke these approvals, and that advice still applies today. Revoking them costs only a small network fee and removes any remaining risk from these old contracts.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.