Kronos Research, a leading liquidity provider in the crypto space, announced on Monday that some of its API keys had been compromised by an unknown attacker, resulting in a loss of more than $25 million worth of Ethereum (ETH).
According to a tweet from the company, all transactions were suspended as soon as the breach was detected, and an investigation is underway to determine the extent of the damage and the identity of the hacker.
Hacker exploited a vulnerability in the WOO Network smart contract
WOO Network, a decentralized trading platform that partners with Kronos Research, also confirmed the incident and said that it had temporarily halted all transactions to protect the safety of users’ positions. The platform later resumed normal operations and assured users that their funds were safe.
ZachXBT, a crypto analyst and trader, claimed that the hacker had exploited a vulnerability in the WOO Network smart contract, allowing them to withdraw ETH from Kronos Research’s account. He estimated the total loss at 12,800 ETH, equivalent to about $25.6 million at the current market price.
$22 million of the stolen funds were transferred to Binance
The hacker did not stop there, however. According to @x_explore_eth, a Twitter account that tracks Ethereum transactions, more than $22 million of the stolen funds were transferred to Binance, the world’s largest crypto exchange by volume, in an attempt to cash out. The hacker’s funding flow was traced as CEX -> Kronos Research -> Hacker.
The reason why the hacker did not withdraw the funds directly from CEX to their own address may be due to the whitelisting mechanism that requires users to verify their withdrawal addresses before sending funds, @x_explore_eth speculated.
Binance has not yet commented on the matter, but it is expected that the exchange will cooperate with the authorities and freeze the hacker’s account if possible.
Kronos Research working hard to recover the lost funds
This is not the first time that Kronos Research has been targeted by hackers. In July 2022, the company reported a $5.4 million loss due to a flash loan attack on its leveraged yield farming product, Kronos Vault.
The incident highlights the risks and challenges faced by the crypto industry, especially in the decentralized finance (DeFi) sector, where hackers often exploit loopholes and bugs in smart contracts to steal funds from users and platforms.
Kronos Research said that it is working hard to recover the lost funds and prevent future attacks, and that it will update the public as soon as possible. The company also thanked its users and partners for their support and understanding.
