BSCex Hack

BSCex was a decentralized exchange on BNB Chain that later rebranded to LaunchZone. Its SwapX contracts let users swap tokens, which meant approving them to spend those tokens. Four old versions of these contracts had a serious flaw: they did not check who was asking them to make a trade. That let anyone make trades on behalf of a wallet that had approved them, for example by forcing it to swap its tokens for worthless tokens that the attacker controlled, draining its value in the process.

The first drain happened on 27 February 2023. LaunchZone announced the exploit the next day and estimated the damage at around $320k, but that figure turned out to be far too low. In March 2023, the security firm ScamSniffer found that all four vulnerable contract versions were being drained, one after another, with losses much higher than LaunchZone's estimate. In total, over $7.8M has been stolen. Many of the approvals being abused had been given two to three years before the attacks.

These old contracts are still vulnerable, and many wallets still have active approvals to them, so drains have continued for years after the first attack. If you ever used BSCex or SwapX on BNB Chain, check your wallet and revoke any approvals that remain for these contracts, even if you stopped using them long ago. Revoking protects the tokens that are still in your wallet, but it does not recover tokens that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.