ApolloX项目遭受黑客攻击事件分析

CertikPublicado em 2022-06-10Última atualização em 2022-06-10

Resumo

北京时间2022年6月8日晚7点左右，CertiK审计团队监测到ApolloX项目遭受黑客攻击，其代币（APX）价格骤降52.12%。

该项目于2021年12月启动，APX作为ApolloX交易所的原生代币，是币安智能链（BSC）上的一个BEP-20代币。

攻击者(0x9e532b19abd155ae5ced76ca2a206a732c68f261)通过反复调用ApolloxExchangeTreasury中的函数claim()，从该合约中获得约5300万APX代币，后来被换成了210万枚BUSD（价值约210万美元）。攻击者共进行了8次交易。

当日ApolloX正式宣布他们被黑客攻击，并计划通过公开回购APX和从交易所交易费中赚取的APX来弥补损失。

推特公告链接：https://twitter.com/ApolloX_com/status/1534570239177789440

攻击步骤

①攻击者调用多个合约，而这些合约又反复调用ApolloxExchangeTreasury中的claim()函数。该函数用ECDSA.recover()成功验证了输入的信息和签名，并将相应的代币金额从合约中转移到攻击者手中。

②攻击者通过PancakeSwap将APX代币大量换成BUSD。

漏洞交易

攻击者利用以下这些交易盗取了ApolloX代币：

https://bscscan.com/tx/0x21e5e6ee42906a840c07eb39fb788553a3fbb5794562825c2a1d37bfc910e5f7

https://bscscan.com/tx/0x67a90c1af85c626460b928ccfde66432dd828b838038ef15400c577ee5386926

https://bscscan.com/tx/0xccc9e8ebf0472272b83e328a11e5aa5eb712c831dcd5bae32622dc238005aee0

https://bscscan.com/tx/0x34b29a393b68ae0f2e417485fb57ea7510a253c1b01431d04a66ca61e4fbbc8c

在PancakeSwap上的调换操作:

500万APX换取了246,560BUSDhttps://bscscan.com/tx/0xc2607de512e31737659b78e8b6f6cc4a82b10f3da953e901e95a0c7beea440de

700万APX换取了291,276BUSDhttps://bscscan.com/tx/0xe944b576b46402c830bf79062ba22728c55c87c73062f944f01d71d7fb707f53

700万APX换取了246,243BUSDhttps://bscscan.com/tx/0x55c45952611cdd1b1d1c168c1b0bd6198ff64c71abb67aecda8ffa4057758cc6

700万APX换取了213,971BUSDhttps://bscscan.com/tx/0x57030b6e64f81b854601abc5953837d4d7b3f2534593a1f48485fffd37630b94

700万APX换取了160,999BUSD

https://bscscan.com/tx/0xf25688d3651bbade2cb67835050678ad4ab6f15f140a162fc2c3eed1821f8ec0

700万APX换取了115,535BUSD

https://bscscan.com/tx/0xdf7e67aa67b8e56265cb05866d026015d0d6cafcefff5ba957b849df66a34284

700万APX换取了183,061BUSD

https://bscscan.com/tx/0x72c7c6b8c73d4e70905c48f7fcc6a5c4a0ba27323067e7bbf2fae8f2cf80be02

约700万APX换取了143,451BUSD

https://bscscan.com/tx/0x902ebbe7418c719032b524be101c2f3d88f8e061f85e19c5b6ab62a4b65b83c0

资产去向

①攻击者赚取了约210万BUSD，资产通过以下3个交易被转移到ZAPbridge👇

0x3d141a94a914947b3cc611f3e44d81be9f3147a9afaf168c57c4b5c638b16f71

0x07e4438429c55cfc1d1b2fcb8eb10cadc579d0b16c7b78af78a26448bc8b1d28

0x25ee8fc7d26ef11bce3d546517134b125d306f00bba253a2c13e6dcdc35b64f2

②随后被转移至以太坊的地址：0x9E532b19Abd155Ae5ced76cA2a206A732c68f261

写在最后

通过审计，我们可以发现这一风险因素。

项目团队使用的是Openzeppelin3.2.0版的标准ECDSA，签名的生成在合约之外。

正常情况下，签名的中心化控制可被监测到，以“中心化风险”的审计结果呈现于审计报告中。

Leituras Relacionadas

Stablecoins Adoption: French Finance Minister Pushes For More Euro-Backed Tokens

France's Finance Minister Roland Lescure has called for the development of more euro-pegged stablecoins to reduce reliance on US dollar-dominated payment systems. He noted that the current volume of euro stablecoins is "not satisfactory," representing only 0.207% of the global stablecoin market. Lescure praised the Qivalis initiative by European banks like ING and BNP Paribas to launch a euro stablecoin in 2026. This push is part of broader EU efforts to achieve financial independence amid tensions with the US. Additionally, Lescure encouraged European banks to adopt tokenized deposits, following the lead of major global banks.

bitcoinistHá 25m

Stablecoins Adoption: French Finance Minister Pushes For More Euro-Backed Tokens

bitcoinistHá 25m

DeFi Hacked Again for $292 Million, Is Even Aave No Longer Safe?

On April 19, a major DeFi security breach occurred, resulting in the loss of approximately $292 million. The attack targeted Kelp DAO’s rsETH bridge contract built on LayerZero, with 116,500 rsETH stolen. The attacker initiated the exploit using funds from Tornado Cash and manipulated the LayerZero EndpointV2 contract to transfer the assets. Kelp DAO confirmed the incident and temporarily paused rsETH contracts across multiple networks while collaborating with security experts for investigation. Initial analysis suggests the root cause was a compromised private key on the source chain, with the contract secured by only a 1/1 validator set, making it vulnerable to a single malicious transaction. The attacker used the stolen rsETH as collateral on lending platforms—including Aave, Compound, and Euler—to borrow more liquid assets like WETH, accumulating over $236 million in debt. Aave alone accounted for $196 million of this amount. In response, Aave froze its rsETH markets and stated it would explore covering potential bad debt through its Umbrella safety module, which holds around $50 million in WETH. This incident follows another large exploit earlier in April, where Drift Protocol on Solana lost $280 million. The repeated high-value attacks raise concerns about DeFi security, even affecting major protocols like Aave. Users are advised to exercise caution, diversify holdings, and limit exposure to on-chain protocols until more robust security measures are established.

marsbitHá 26m

DeFi Hacked Again for $292 Million, Is Even Aave No Longer Safe?

marsbitHá 26m

DeFi Hacked Again, Losing $292 Million: Is Even Aave No Longer Safe?

On April 19, DeFi suffered another major security breach, with liquid staking protocol Kelp DAO losing approximately 116,500 rsETH (worth around $292 million) due to an exploit in its LayerZero-based bridge contract. The attack originated from a compromised private key on the source chain, allowing the hacker to initiate unauthorized transfer via a single validator. The attacker used the stolen rsETH as collateral on lending platforms including Aave, Compound, and Euler to borrow more liquid assets like wETH, resulting in over $236 million in debt—$196 million from Aave alone. Aave quickly froze its rsETH markets and announced it would explore covering potential bad debt through its Umbrella safety module, which holds about $50 million in WETH. This incident follows a $280 million exploit on Solana’s Drift Protocol earlier in April, raising further concerns about DeFi security. Even established protocols like Aave are now indirectly exposed, prompting warnings for users to diversify holdings and limit exposure to smart contract risks. Investigations are ongoing.

Odaily星球日报Há 33m

DeFi Hacked Again, Losing $292 Million: Is Even Aave No Longer Safe?

Odaily星球日报Há 33m

Analyst Reveals Why He Doesn’t See XRP Price Crashing Below $1

Crypto analyst Crypto Luke remains bullish on XRP, arguing that the price is unlikely to crash below $1 despite a significant decline from its 2025 peak. Key reasons include the defense of a broadening wedge pattern, indicating strong market demand, and bullish signals from technical indicators like the Stochastic and RSI. He notes liquidity is returning to XRP, supported by net inflows, suggesting institutional buying. While not predicting an immediate surge, he advises accumulating XRP at current levels rather than selling.

bitcoinistHá 4h

Analyst Reveals Why He Doesn’t See XRP Price Crashing Below $1

bitcoinistHá 4h

Bitcoin Miners Selling Nears Exhaustion – What Comes Next

Bitcoin miner selling pressure is nearing exhaustion, according to on-chain data, potentially setting the stage for the next market upswing. Analysts note that public miners sold over 32,000 BTC in Q1 2026—the largest quarterly outflow on record—driven by reduced block rewards after the 2024 halving and rising operational costs. Key metrics show declining miner reserves and a negative net position change, but the intensity of selling is now weakening. This suggests the phase of miner-driven supply pressure is ending, shifting Bitcoin market dynamics toward demand-led growth. Future price movement may depend more on ETF inflows, institutional interest, and macro conditions. Bitcoin currently trades around $77,169.

bitcoinistHá 6h

Bitcoin Miners Selling Nears Exhaustion – What Comes Next

bitcoinistHá 6h

Trading

Spot

Futuros