Liquid Crypto Hack

Liquid Crypto is a DeFi liquidity protocol that runs on several blockchains and has its own LQDX token, which launched in December 2023. Its zap contracts let users deposit into Liquid Crypto pools in a single step, and to use them people approved the zaps to spend their tokens. On 10 January 2024, it turned out that the zaps never checked who was asking for a deposit. Anyone could start a deposit on behalf of any wallet that had approved a zap and use that wallet's tokens without its consent.

An attacker abused this flaw, and about $2k was stolen from users. Security firm SlowMist spotted the suspicious activity, publicly urged users to revoke their approvals to the zaps and asked Liquid Crypto to get in touch. The vulnerable zaps were deployed on Ethereum, BNB Chain, Avalanche, Mantle and JFIN Chain. Liquid Crypto responded by deploying new zap contracts for its app.

The old zap contracts were left in place rather than shut down, so any approval to them can still be abused in the same way. If you used Liquid Crypto before January 2024, check your approvals on every chain listed here and revoke any to the old zaps. SlowMist also flagged a zap on ONUS Chain that this list does not cover, so check that chain separately if you used it. Revoking protects what is still in your wallet, but it does not recover lost funds.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.