Anrk protocol under attack: all the details of the hack

BNB Chain decentralized finance projects remain popular targets for hackers. In today’s rapid hack of the Anrk protocol, attackers released 6 quadrillions (6kkkk) aBNBc and earned at least $15 million (not counting over $30 million in money already frozen by exchanges).

A brief summary of what happened

Hackers cracked the Ankr decentralized protocol and took advantage of a smart contract bug to issue an additional 6 quadrillion aBNBc tokens. The hacker completely emptied the aBNBc liquidity pools on PancakeSwap and ApeSwap by staging a sale.

After the attack, the price of aBNBc token dropped by more than -99%.

In a tweet, an Ankr spokesperson confirmed the hack and said he was working with exchanges to suspend withdrawals. Binance was the first to suspend withdrawals and also froze ~$3 million that the hackers transferred to the exchange. Now the Ankr hacker is withdrawing stolen funds via Ethereum using the infamous Tornado Cash mixer.

In total, the attackers managed to steal more than $15 million worth of cryptocurrency.

More details

The name of aBNBc token stands for Ankr Reward Bearing Staked BNB — users receive these tokens for staking BNB coins in the protocol from Binance.

The hacker has already exchanged some of the funds received using the decentralized exchanges Uniswap, PancakeSwap and ApeSwap, the Tornado Cash mixer and various interconnect bridges. He has received about 15 million USDC. 

Possible hacks on Ankr and Hay. Initial analysis is developer private key was hacked, and the hacker updated the smart contract to a more malicious one. Binance paused withdrawals a few hrs ago. Also froze about $3m that hackers move to our CEX.

— CZ 🔶 BNB (@cz_binance) December 2, 2022

So far, details about the hack are somewhat contradictory (there are several versions of what happened, here’s an attempt to reconstruct the chronology of events in detail, and here’s another one). Apparently, the hacker either took advantage of a critical vulnerability in the Ankr smart contract or gained access to the private keys of the protocol administrators. Ankr developers said they are working with various platforms and exchanges to urgently suspend trading in aBNBc tokens. 

Deployer key compromised or inside job, it deployed an attack contract, changed the upgradeable aBNBc contract to the malicious implementation, then called the 0x3b3a5522 function to mint 10,000,000,000 tokens to his wallet. pic.twitter.com/qz1xK94ePQ

— BowTiedPickle.eth | Solidity Shipper (@BowTiedPickle) December 2, 2022

Another hacker took advantage of all the hype. He used the Ankr vulnerability discovered by the first hacker, but in a different way — by cunningly manipulating the exchange of different tokens, he dropped the rate of the HAY stablecoin. 

The only good news in all is that Ankr said it is developing a plan to try to compensate all the affected users. All this trouble has also had a negative impact on the exchange rate of BNB, the Binance exchange coin.

 

How can I make money on this?

In the first hours of the attack it was possible to short aBNBc, and judging by the posts on Twitter, some did just that. At the moment, withdrawals and transactions on this problematic token on most exchanges are frozen. 

According to the news, Ankr management is actively solving the problem and there is a good chance that this protocol will work again. Especially since Binance is behind it, which will not let the project die. If you are ready to take the risk, you can try to pick up BNB coins (which is a proxy for aBNBc coin) at the bottom to sell them after recovery (or keep them for long-term investment as quite an interesting asset).