Anrk protocol under attack: all the details of the hack

BNB Chain decentralized finance projects remain popular targets for hackers. In today’s rapid hack of the Anrk protocol, attackers released 6 quadrillions (6kkkk) aBNBc and earned at least $15 million (not counting over $30 million in money already frozen by exchanges).

A brief summary of what happened

Hackers cracked the Ankr decentralized protocol and took advantage of a smart contract bug to issue an additional 6 quadrillion aBNBc tokens. The hacker completely emptied the aBNBc liquidity pools on PancakeSwap and ApeSwap by staging a sale.

After the attack, the price of aBNBc token dropped by more than -99%.

In a tweet, an Ankr spokesperson confirmed the hack and said he was working with exchanges to suspend withdrawals. Binance was the first to suspend withdrawals and also froze ~$3 million that the hackers transferred to the exchange. Now the Ankr hacker is withdrawing stolen funds via Ethereum using the infamous Tornado Cash mixer.

In total, the attackers managed to steal more than $15 million worth of cryptocurrency.

More details

The name of aBNBc token stands for Ankr Reward Bearing Staked BNB — users receive these tokens for staking BNB coins in the protocol from Binance.

The hacker has already exchanged some of the funds received using the decentralized exchanges Uniswap, PancakeSwap and ApeSwap, the Tornado Cash mixer and various interconnect bridges. He has received about 15 million USDC. 

So far, details about the hack are somewhat contradictory (there are several versions of what happened, here’s an attempt to reconstruct the chronology of events in detail, and here’s another one). Apparently, the hacker either took advantage of a critical vulnerability in the Ankr smart contract or gained access to the private keys of the protocol administrators. Ankr developers said they are working with various platforms and exchanges to urgently suspend trading in aBNBc tokens. 

Another hacker took advantage of all the hype. He used the Ankr vulnerability discovered by the first hacker, but in a different way — by cunningly manipulating the exchange of different tokens, he dropped the rate of the HAY stablecoin. 

The only good news in all is that Ankr said it is developing a plan to try to compensate all the affected users. All this trouble has also had a negative impact on the exchange rate of BNB, the Binance exchange coin.