KiloEx publishes analysis of hacker incident: because the contract did not rewrite key functions, the attacker has returned 90% of the assets stolen across chains

Odaily Planet Daily News KiloEx released a root cause analysis report on the hacking incident on April 21. The report pointed out that the cause of the incident was that the TrustedForwarder contract in its smart contract inherited OpenZeppelin's MinimalForwarderUpgradeable but did not rewrite the execute method, causing the function to be called arbitrarily. The attack occurred from 18:52 to 19:40 (UTC) on April 14, and the attacker deployed malicious contracts on opBNB, Base, BSC, Taiko, B2 and Manta chains to launch the attack. After KiloEx negotiated with the attacker, the other party agreed to keep 10% as a bounty, and the remaining assets (covering USDT, USDC, ETH, BNB, WBTC and DAI) have all been returned to the project's multi-signature wallet. The platform has completed the vulnerability repair and resumed operations.