FTX Hit by GAS Theft Vulnerability, Loses Over 81 ETH

FTX Suffers Major Loss Due to GAS Theft Vulnerability

The FTX cryptocurrency exchange has fallen victim to a GAS theft vulnerability, resulting in the loss of over 81 ETH. Attackers are exploiting this vulnerability to mint XEN tokens at no cost, with FTX covering the transaction fees.

How the Attack Works

Hackers have placed a bug on FTX's hot wallet, causing it to transfer small amounts of ETH to their address repeatedly. This exploit has allowed them to accumulate over 100 million XEN tokens, some of which have been exchanged for 61 ETH via decentralized exchanges like Uniswap and DoDo. The attack remains ongoing.

Vulnerability Assessment Reveals Security Flaws

A vulnerability assessment highlights that FTX lacks restrictions on GAS transfer limits for ETH. The exchange uses the "estimateGas" method, setting the GAS limit at 500,000—24 times higher than the default 21,000. This oversight, combined with the failure to detect frequent small transfers from the same address, has made FTX a target for malicious actors.

Broader Implications in Crypto Security

This incident underscores the vulnerabilities in crypto exchanges' security systems. It follows a recent exploit on the Binance Chain bridge, which lost over $500 million, emphasizing the need for enhanced security measures in the industry.