Jacquelyn Melinek

<div id="highlights-block_61f4106975893" class="highlights">
 <ul>
 <li>“The exploit and loss of funds have a profound effect on thousands of real people,” the company said</li>
 <li>Qubit is continuing to track the exploiter and monitor affected assets and has disabled a number of account management features until further notice</li>
 </ul>
 
</div>



Hackers have stolen $80 million from DeFi protocol Qubit Finance, the firm confirmed on Friday.&nbsp;



The attackers exploited the protocol to take 206,809 Binance coins through Qubit’s QBridge deposit function, making it the seventh largest DeFi hack ever, DeFiYield Rekt <a href="https://defiyield.app/rekt-database" target="_blank" rel="noreferrer noopener">data</a> shows.&nbsp;



The QBridge protocol is an Ethereum-BSC (Binance Smart Chain) bridge that allows users to swap ERC-20 and BEP-20 tokens between the two blockchains. The protocol is implemented as a set of smart contracts built on top of the BSC.



The attacker essentially took advantage of a logical error in Qubit Finance’s code that allowed them to input malicious data and withdraw tokens on BSC when none were deposited on Ethereum, blockchain security firm CertiK <a href="https://certik.medium.com/qubit-bridge-collapse-exploited-to-the-tune-of-80-million-a7ab9068e1a0" target="_blank" rel="noreferrer noopener">explained</a>.&nbsp;



The decentralized money market platform tweeted a statement to notify the exploiter that they were aware of what was happening and proposed a direct negotiation before taking further action.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://t.co/G1WOMglVUU">pic.twitter.com/G1WOMglVUU</a>&mdash; Qubit Finance (@QubitFin) <a href="https://twitter.com/QubitFin/status/1486984216072318977?ref_src=twsrc%5Etfw">January 28, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“The exploit and loss of funds have a profound effect on thousands of real people,” the company said.&nbsp;



The team also contacted the exploiter to offer the maximum bounty as set by its program, it said in a <a href="https://medium.com/@QubitFin/protocol-exploit-report-305c34540fa3" target="_blank" rel="noreferrer noopener">post</a>. It didn’t disclose how much the bounty would be, or if the hacker was receptive.&nbsp;&nbsp;



Qubit is continuing to track the exploiter and monitor affected assets and has disabled a number of account management features until further notice. However, its claiming feature is still available, it said.&nbsp;



“We are continuing to investigate and are in communications with Binance,” Qubit wrote. “Further updates and a full report will be shared as they become available.”



The company was not available for additional comment when requested by Blockworks.&nbsp;



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Qubit

Newsletter

Blockworks Research