KiloEx, a platform for trading perpetual futures, was hacked on the evening of April 14. As a result, the attacker was able to withdraw cryptocurrency worth about $7 million by exploiting a vulnerability in the pricing system. According to Cyvers, the funds were stolen from several networks, including Base, BNB Chain, and Taiko.
A short time later, the KiloEx team confirmed the attack and temporarily suspended the platform. According to them, the weak point in the system was isolated, and an internal investigation into the incident was launched. The main reason for the hack was the manipulation of the price oracle - a mechanism that transmits data on the value of assets from external sources to decentralized applications.
The hacker managed to introduce false price data that the KiloEx system accepted as real. After that, he made a series of leveraged trades. One of these orders, as it turned out, brought the attacker over $3 million in profit in just one transaction, The Block reports.
The day after the attack, KiloEx representatives tried to contact the hacker, offering to return 90% of the stolen funds. As a reward for cooperation, the exchange promised to leave him the remaining 10% - about $700 thousand. The team said that it publicly acknowledged his participation and would not take legal action if he agreed to the terms.
“If you are ready to cooperate, contact us. We will publish information about reaching an agreement and close the case,” the exchange said in a statement.
However, the exchange warned that if the attacker refuses to cooperate, it will hand over the investigation materials to law enforcement agencies and cybersecurity companies. KiloEx threatened to reveal the identity of the hacker and bring the case to court.
Such attacks have happened before. One high-profile case was the Mango Markets hack in 2022, when Abraham Eisenberg manipulated futures prices to make $110 million. He was later arrested in Puerto Rico and convicted of fraud in the US in 2024.