dYdX Hack

dYdX is a decentralized crypto exchange. On 24 November 2021, it launched a new deposit contract that let users fund their dYdX account with a wide range of tokens, converting them to USDC along the way. To use it, users approved the contract to spend their tokens. Three days later, on 27 November 2021, a member of a trading firm reported that the contract could be tricked into transferring tokens out of any wallet that had approved it, without the owner's permission.

Within hours, dYdX used the same bug to rescue about $2M of vulnerable funds, moving them into an escrow contract that only the original owners can withdraw from. A recovery bot run by dYdX rescued another $533k in the same way. Despite these efforts, automated bots managed to steal just over $200k before those funds could be secured. dYdX reimbursed these losses in full out of its own pocket, covered users' gas costs, and paid the person who reported the bug a $500k bounty.

At the time, affected users could revoke their approvals and reclaim any escrowed funds through the dYdX website. dYdX warned them not to send tokens to their wallet until they had revoked, because any tokens covered by an approval could still be taken. That warning still applies: if you still have an approval to this deposit contract, revoke it before sending any tokens to that wallet.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.