In the early morning of April 15, KiloEx, an on-chain perpetual platform that had previously been invested by YZi Labs, issued an announcement on its official X account, stating that its protocol vault, KiloEx Vault, was hacked and the vulnerability attacks have been controlled.

Affected by the theft, the price of KiloEX token KILO began to fall sharply before the official announcement. As of writing, KILO had fallen from around $0.05 at 4 a.m. to $0.035, a 6-hour drop of more than 30%. According to DefiLlama data, funds in KiloEx also fell and fled rapidly during the vulnerability attack. As of writing, the protocol's cross-chain TVL had dropped to less than $31 million.

In response to the attack, KiloEx officially responded that it had immediately suspended the use of the platform and was working with security partners to track the flow of funds. The team will release a bounty program and work with ecosystem partners to track and recover funds as much as possible. In addition, KiloEx said it will release a complete incident report to share with the community in the near future.

The reason for the stolen is a price oracle loophole

According to Paidunmonitor, the perpetual contract DEX KiloEx was attacked today, losing about $7.5 million (of which $3.3 million was on the Base network, $3.1 million on the opBNB network, and $1 million on the BNB Chain).

Through preliminary analysis of one of the attack transactions, Paidun believes that this is a price oracle problem. The attacker took advantage of the vulnerability and set the initial price of ETHUSD to 100 when opening the position, and then immediately closed the position at an inflated ETHUSD price of 10,000, making a profit of about $3.12 million in this transaction alone. And according to Cyvers Alertstrack, the attacker continues to try to attack KiloEx's oracle system after making a large profit.

Cyvers Alerts said the USDC earned by the attacker may face a freeze and called on Tether to actively freeze USDT assets obtained by the attacker. At present, the attacker has deposited the funds through Across cross-chain to the address 0x00FAC92881556A90FDB19EE9F23640B95B4BCBD.

The plane crashed as soon as it took off, and the team's solvency caused doubts

KiloEx is a decentralized perpetual contract platform that supports multiple MEV ecosystems L1 and L2 of BNB Chain, opBNB, and Base. In August 2023, YZi Labs announced investment in four excellent MVB VI projects, including KiloEx, and KiloEx is also a project member of the BNB Chain Airdrop Alliance Program.

As YZi Labs' "godson", KiloEx's development has been very smooth in the previous period. On March 27, Binance Wallet teamed up with PancakeSwap to host an exclusive token generation event for KiloEx. Currently, BNB has been open for 62 minutes, with 58 minutes remaining before the end. It has exceeded the subscription by 281 times and raised more than 340,000 BNBs.

On April 13, KiloEx announced a strategic partnership with Web3 investment institution and market maker DWF Labs. The two sides will carry out in-depth collaboration on KiloEx market expansion, ecological growth and user empowerment to further promote KiloEx's layout in the field of decentralized trading.

KiloEx said it will launch more integrated cooperation with DWF Labs on BNB Chain in the near future to further promote the coordinated development of platform functions and ecosystems. According to the Binance Alpha market, KiloEx token KILO rose 45% on the day after the news was announced, reaching a maximum of US$0.058.

Just two days after the project momentum began, KiloEx suffered more than $7 million in losses due to oracle vulnerabilities. According to Coingecko, the current circulating market value of the KiloEx project has fallen to around $7.36 million, which is similar to its stolen funds, while its full circulating market value is about $34 million. Because the amount of stolen accounts for too much of the project's market value, many members of the community have reported concerns about the team's solvency.