Slow Mist: OKX DEX Proxy Admin Owner private key leaked

According to news from the Slow Mist Zone, there is a suspected problem with the OKX DEX contract. After Slow Mist analysis, it was found that the user will authorize the TokenApprove contract when exchanging, and the DEX contract transfers user tokens by calling the TokenApprove contract. The DEX contract has a claimTokens function that allows trusted DEX Proxy to call it. Its function is to call the claimTokens function of the TokenApprove contract to transfer the tokens of authorized users. Trusted DEX Proxy is managed by Proxy Admin, and Proxy Admin Owner can upgrade the DEX Proxy contract through Proxy Admin. Proxy Admin Owner upgraded the DEX Proxy contract to a new implementation contract through Proxy Admin at 2023-12-12 22:23:47. The new implementation contract function is to directly call the claimTokens function of the DEX contract to transfer tokens. The attacker then started calling DEX Proxy to steal tokens. Proxy Admin Owner upgraded the contract again at 2023-12-12 23:53:59, and the functions were similar to those before. After the upgrade, he continued to steal tokens. As of now, the profit is about 430,000 U. The attack may be due to the leakage of the Proxy Admin Owner's private key. Currently, DEX Proxy has been removed from the trusted list. Related Information: DEX contract: 0x70cbb871e8f30fc8ce23609e9e0ea87b6b222f58 OKX DEX TokenApprove contract: 0x40aa958dd87fc8305b97f2ba922cddca374bcd7f DEX Proxy: 0x55b35bf627944396f9950dd6bddadb5218110c76 Proxy Admin: 0x3c18F8554362c3F07Dc5476C3bBeB9Fdd6F6a500 Proxy Admin Owner: 0xc82Ea2afE1Fd1D61C4A12f5CeB3D7000f564F5C6 Upgrade transaction: https://etherscan.io/tx/0xc6a5a7bc31bbc9a7530189e718f7ed96789fa65c56c3a4a08079a95074e280c8 https://etherscan.io/tx/0x22ebd267d7344780e6d63cf3a76bab57b8f8fa41cf58df1a2e1707d75d8bee89 Suspected attacker: 0xFacf375Af906f55453537ca31fFA99053A010239; Profitable address: 0x1F14E38666cDd8e8975f9acC09e24E9a28fbC42d.