Evoq Finance Suffers $420,000 Loss in BNB Chain Smart Contract Attack

According to PANews, Evoq Finance's smart contract on the BNB Chain was compromised, resulting in a significant security breach. The attacker managed to steal the owner's account, transferring ownership to themselves and subsequently upgrading the contract to a malicious version. This led to the theft of approximately $420,000 from the protocol and user approvals. Users are advised to immediately revoke token approvals for the contract at address 0xF9C74A65B04C73B911879DB0131616C556A626bE to prevent further losses. The project team is urged to implement multi-signature protection and regular key rotation to safeguard high-privilege accounts. The attack overview indicates that the perpetrator likely obtained the private key of the owner's account (0xF08d1c) and used the transferOwnership function to shift ownership to their address (0x7b416F). They then upgraded the proxy contract, draining funds from both the contract and approved user accounts.