KiloEx Compensates Traders, Stakers After $7.5M Exploit

Decentralized exchange (DEX) KiloEx has announced that it will compensate traders and stakers affected by a $7.5 million exploit that temporarily shut down the platform earlier in April. The platform confirmed that the attacker exploited a permissionless function, allowing them to open a position at an artificially low price and close it at a higher price, resulting in illegitimate profits.

In an April 24 announcement, KiloEx stated that traders who had positions open while the platform was suspended would receive full compensation if their losses increased or profits decreased. The platform emphasized the importance of closing positions immediately once operations resume, as delays could affect profit and loss calculations, impacting the compensation amount.

For Hybrid Vault stakers, KiloEx assured that the stolen funds were fully reinjected into the vault, ensuring that staker earnings and principal remain unaffected. Additionally, the platform will provide an extra 10% annual percentage yield (APY) as a bonus for eligible stakers who had funds in the vault prior to the platform’s resumption.

On April 15, KiloEx offered a 10% bounty to the hacker, allowing them to keep $750,000 if they returned 90% of the stolen funds. The platform threatened legal action if the hacker did not comply. Shortly after, security platforms flagged transactions indicating that the hacker returned the stolen funds. On April 18, KiloEx withdrew all legal action and rewarded the hacker with a 10% white hat bounty.

Security firm PeckShield reported that the attacker likely exploited a price oracle vulnerability, inflating prices to gain more profit than they should have. KiloEx confirmed in a post-mortem that the attacker crafted a request that only authorized entities should have been able to do, highlighting the need for enhanced security measures to prevent such exploits in the future.