Jacquelyn Melinek

<div id="highlights-block_61f4106975893" class="highlights">
        <ul>
                <li>“The exploit and loss of funds have a profound effect on thousands of real people,” the company said</li>
                <li>Qubit is continuing to track the exploiter and monitor affected assets and has disabled a number of account management features until further notice</li>
            </ul>
    
</div>



<p>Hackers have stolen $80 million from DeFi protocol Qubit Finance, the firm confirmed on Friday.&nbsp;</p>



<p>The attackers exploited the protocol to take 206,809 Binance coins through Qubit’s QBridge deposit function, making it the seventh largest DeFi hack ever, DeFiYield Rekt <a href="https://defiyield.app/rekt-database" target="_blank" rel="noreferrer noopener">data</a> shows.&nbsp;</p>



<p>The QBridge protocol is an Ethereum-BSC (Binance Smart Chain) bridge that allows users to swap ERC-20 and BEP-20 tokens between the two blockchains. The protocol is implemented as a set of smart contracts built on top of the BSC.</p>



<p>The attacker essentially took advantage of a logical error in Qubit Finance’s code that allowed them to input malicious data and withdraw tokens on BSC when none were deposited on Ethereum, blockchain security firm CertiK <a href="https://certik.medium.com/qubit-bridge-collapse-exploited-to-the-tune-of-80-million-a7ab9068e1a0" target="_blank" rel="noreferrer noopener">explained</a>.&nbsp;</p>



<p>The decentralized money market platform tweeted a statement to notify the exploiter that they were aware of what was happening and proposed a direct negotiation before taking further action.&nbsp;</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="und" dir="ltr"><a href="https://t.co/G1WOMglVUU">pic.twitter.com/G1WOMglVUU</a></p>&mdash; Qubit Finance (@QubitFin) <a href="https://twitter.com/QubitFin/status/1486984216072318977?ref_src=twsrc%5Etfw">January 28, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>“The exploit and loss of funds have a profound effect on thousands of real people,” the company said.&nbsp;</p>



<p>The team also contacted the exploiter to offer the maximum bounty as set by its program, it said in a <a href="https://medium.com/@QubitFin/protocol-exploit-report-305c34540fa3" target="_blank" rel="noreferrer noopener">post</a>. It didn’t disclose how much the bounty would be, or if the hacker was receptive.&nbsp;&nbsp;</p>



<p>Qubit is continuing to track the exploiter and monitor affected assets and has disabled a number of account management features until further notice. However, its claiming feature is still available, it said.&nbsp;</p>



<p>“We are continuing to investigate and are in communications with Binance,” Qubit wrote. “Further updates and a full report will be shared as they become available.”</p>



<p>The company was not available for additional comment when requested by Blockworks.&nbsp;</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.</strong></p>



<p></p>
