Arbitrum Stablecoin Exploiter Snagged $300K From 9.7B Token Boost

The “puzzling” attack showed no transfer logs of minting or transferring the infinite number of tokens, a blockchain sleuth said

by Shalini Nagarajan /

February 6, 2023 10:57 am

Brian A Jackson/Shutterstock.com modified by Blockworks

SperaxUSD, a yield automator on Ethereum layer-2 rollup Arbitrum, announced a user was able to explode the balance of their stablecoin tokens over the weekend.

In a Twitter thread, the team said an exploiter somehow obtained 9.7 billion USDS tokens for barely any collateral and managed to liquidate around $300,000 worth before being blocked by the Sperax and Arbitrum teams.

The Sperax team has identified the account and is in the process of taking action in coordination with centralized exchanges. The liquidated amount will be recapitalized before the protocol’s relaunch, it said. The exploit did not impact the DeFi protocol’s governance token SPA.

Newsletter

Subscribe to The Breakdown

Loading Tweet..

SperaxUSD didn’t return Blockworks’ request for comment on further details, but a detailed report was set to be published Monday.

“We have reached out to the exploiter to discuss options and we are hopeful for a peaceful resolution. The issue has been figured out and will be resolved with a smart contract upgrade. Recapitalization will be implemented early next week, then transactions will restart,” the team said.

Code bug?

A blockchain analyst who goes by the name “Spreek” on Twitter provided the likely attacker’s address in a tweet, singling out its Ethereum Name Service as “kochironnosaif.eth.”

The attack was “puzzling” as there were no transfer logs of minting or transferring the infinite number of tokens, nor was there any malicious upgrade to the contract, the sleuth said.

“Therefore I would guess [the] likely cause is [a] bug in rebasing code,” they said.

Blockchain security firm PeckShield said the root cause of the hack was due to an “internal balance accounting discrepancy caused when migrating an account from non-rebasing to rebasing-based accounting.”

Loading Tweet..

SperaxUSD is a “hybrid” stablecoin whose design includes both collateral-backing and an algorithmic stabilization mechanism, according to its white paper.

Get the news in your inbox. Explore Blockworks newsletters:

The Breakdown: Decoding crypto and the markets. Daily.
0xResearch: Alpha in your inbox. Think like an analyst.

Tags

Newsletter

The Breakdown

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Digital Asset Summit 2026

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

buy tickets learn more

recent research

Research

Kinetiq Protocol: From LST Infrastructure to HIP-3 Deployer

Kinetiq has established itself as Hyperliquid's dominant liquid staking protocol, holding 82.5% of LST market share with $610M in TVL. The protocol is now expanding beyond its kHYPE staking core into higher take-rate verticals: iHYPE for institutional custody rails, Launch for HIP-3 capital formation, and Markets for builder-deployed perpetuals. We view Markets, launching Jan. 12, as the highest-potential product line given its mechanically scalable, activity-linked unit economics. Near-term revenue remains anchored by kHYPE's KIP-2 fee schedule (~$1.6M annualized), while Markets provides embedded optionality if HIP-3 economics normalize post-Growth Mode. KNTQ's setup is relatively clean: zero insider unlocks until November 2026, 6.2% buyback yield from staking revenue, and cleared airdrop overhang. Risks center on unproven Markets execution, declining kHYPE TVL despite ongoing incentives, and competition from Hyperliquid's native initiatives.

by Shaunda Devens