KiloEx, a decentralized finance (DeFi) platform, tools and liquidity operations have been suspended. This decision comes on the heels of a severe security breach that resulted in losses of around $7.5 million. The attack, which was blamed on oracle manipulation and cross-chain vulnerabilities, sheds light on the systemic risks that are rampant across the DeFi industry. Blockchain analysts have been able to follow the attack’s funding back to Tornado Cash. This privacy regulation is often linked to laundering dirty money.
That exploit targeted a flaw in KiloEx’s price oracle system. This security hole in the protocol enabled the attacker to move around assets and alter prices in their favor.
In particular, the attacker targeted KiloEx’s ETH/USD price oracle. When creating leveraged positions, they open them at an artificially low price of $100.
Upon finalizing these trades, the adversary pumped the price oracle up to $10,000. This gap allowed the attacker to earn huge profits, such as $3.12 million in one transaction.
KiloEx has temporarily halted all activity on the platform to prevent any additional harm. They’re already figuring out the complete scope of the exploit. The company claims to be hard at work trying to understand the vulnerabilities that have allowed this attack to happen and addressing those vulnerabilities.
To speed up and optimize the whole process of reclamation, KiloEx intends to launch a bounty program. To support this effort we will be hosting top white-hat hackers and security researchers to help find these missing assets and their recovery. The bounty program leverages skills of the entire cyber community. Its aim is to enhance the platform’s security measures and prevent similar attacks from happening in the future.
The attacker’s funding source, of course, has ties to Tornado Cash. This connection to the exploit itself has led to speculation that criminal actors may have been involved in the exploit. This relationship illustrates how difficult it is for DeFi platforms to prevent anonymity-related money laundering risk despite their transparency benefits.
