DeFi Protocol Qubit Finance Hacked, Lost $80 Million

Qubit Finance, a Binance Smart Chain-based decentralized finance (DeFi) protocol, was recently attacked, resulting in the theft of more than $80 million worth of cryptocurrencies , the team behind the project confirmed on Friday.

The developers detailed that the attackers minted an unlimited amount of xETH without depositing enough collateral to borrow on the blockchain.

The protocol was exploited by;
0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
The hacker minted unlimited xETH to borrow on BSC.
The team is currently working with security and network partners on next steps.
We will share further updates when available.
— Qubit Finance (@QubitFin) January 28, 2022

Qubit is a DeFi protocol that allows users to borrow loans against crypto collateral for fixed interest rates. Additionally, the protocol functions across blockchains, and thus allows borrowers to collateralize their assets without moving them from chain to chain. The protocol does not have any central authority and functions using smart contracts.

The blockchain analytics firm, Peckshield, pointed out that the attack resulted in the draining of 206,809 Binance coins (BNB) from wallet addresses connected to Qubit’s QBridge protocol.

The attacker used the deposit function in QBridge and tricked the protocol without sufficient deposit to illicitly mint 77,162 qXETH. These steps were repeated several times.

“In summary, the deposit function was a function that should not be used after deposit ETH was newly developed, but it remained in the contract,” the Qubit team wrote in an official report. The team is still monitoring the compromised assets and is cooperating with security and network partners, including Binance.

As a security measure, the developers disabled most of the functions of the protocol including supply, redeem, borrow, repay, bridge and bridge redemption, but claiming is still available.

Vulnerabilities in DeFi

DeFi is seen as the real decentralized challenger to the existing banking industry. But, despite the promises, this protocol remains extremely vulnerable to security breaches. Over recent months, several DeFi platforms like Grim Finance, Cream Finance, pNetwork have been hacked.

The latest attack on Qubit was the seventh-largest crypto theft- based on the fiat value, from any DeFi platform to date. As a result, the market value of Qubit’s QBT token slipped by almost 25 percent in the past 24 hours.

The developers detailed that the attackers minted an unlimited amount of xETH without depositing enough collateral to borrow on the blockchain.

The protocol was exploited by;
0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
The hacker minted unlimited xETH to borrow on BSC.
The team is currently working with security and network partners on next steps.
We will share further updates when available.
— Qubit Finance (@QubitFin) January 28, 2022

The blockchain analytics firm, Peckshield, pointed out that the attack resulted in the draining of 206,809 Binance coins (BNB) from wallet addresses connected to Qubit’s QBridge protocol.

The attacker used the deposit function in QBridge and tricked the protocol without sufficient deposit to illicitly mint 77,162 qXETH. These steps were repeated several times.

As a security measure, the developers disabled most of the functions of the protocol including supply, redeem, borrow, repay, bridge and bridge redemption, but claiming is still available.