bZx Hack

bZx was a DeFi platform for lending and trading that ran on Ethereum, BNB Chain and Polygon. On 5 November 2021, a bZx developer opened a phishing email with a malicious Word document attached. This gave the attackers access to the developer's wallet, which also held the admin keys for bZx on BNB Chain and Polygon. They used those keys to change the contracts so they could take the protocol's funds and pull tokens from any wallet that had approved bZx. The Ethereum version was governed separately by the bZx DAO and was not affected.

In total, more than $55M was stolen, including a large amount of bZx's own BZRX token and stablecoins taken from users' wallets. It was not the first time, as bZx had already been exploited several times in 2020. Some of the stolen funds were frozen, including USDT and funds sent to Binance. A couple of weeks after the attack, the bZx DAO approved a compensation plan. Stolen BZRX was replaced in full, while other losses were paid in a debt token worth 25% more than the loss, to be bought back over time using 30% of protocol revenue.

In December 2021, the protocol moved to a successor called Ooki. In June 2023, a US court ruled against Ooki DAO in a case brought by the CFTC and ordered its website to be shut down. The BNB Chain and Polygon contracts were taken over by the attackers, so any approval to them remains dangerous. If you ever used bZx on BNB Chain or Polygon, revoke those approvals now. The compensation plan only covered past losses and does not protect tokens that are still approved today.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.