KiloEX Suspends Platform After $7.5M Exploit

Decentralized exchange KiloEX has confirmed that it has suspended the usage of its platform following a $7.5 million exploit. The platform has been taken offline, and an investigation is underway to trace the stolen funds. In a statement released on April 14, the KiloEX team announced that they have immediately suspended platform usage and are collaborating with security partners to trace the flow of funds. The team is also analyzing the attack vector and affected assets, working with ecosystem partners to trace and recover funds where possible.

The exploit has been contained, and the KiloEX team is actively working to mitigate the damage. A bounty program and a full report on how the exploit occurred are also in the works. The team is collaborating with BNB Chain, Manta Network, and cybersecurity firms Seal-911, SlowMist, and Sherlock in an effort spanning multiple ecosystems. The investigation has confirmed that the stolen assets are currently being routed through zkBridge and Meson, and the team is urgently attempting to engage with both protocols to halt ongoing transactions and prevent additional losses.

Cybersecurity firm PeckShield has speculated that the exploit is likely due to a price oracle issue. According to PeckShield, the exploiter looted a total of $7.5 million, including $3.3 million in Base, $3.1 million in opBNB, and $1 million in BSC. The firm's initial analysis indicates that the hacker exploited a price oracle issue to create a new position with an initial given ETH/USD price of 100 and then immediately closed the position with an inflated ETH/USD price of 10,000, netting a $3.12 million profit in one single transaction. Chaofan Shou, co-founder of blockchain analytics firm Fuzzland, also weighed in, speculating that the exploit was likely due to a price oracle issue. Shou noted that the vulnerability was "very simple" and that anyone could change the Kilo’s price oracle.

KiloEX was established in 2023 and is backed by Binance Labs, which is a lead investor and strategic partner. This exploit comes just days after the exchange announced a partnership with a Dubai-based Web3 venture capitalist firm on April 13, which promised to expand KiloEx's market presence and accelerate growth. The firm had launched a $250 million Liquid Fund on March 25 to accelerate the growth of mid- and large-cap blockchain projects and drive real-world adoption of Web3 technologies.