Ankr hack — December 2022

On 1 December 2022 an attacker used a compromised deployer key to deploy a modified aBNBc contract — Ankr's liquid-staking token for BNB — carrying an extra mint method with no authorisation checks, then minted a vast quantity of the token and sold it into decentralised exchange liquidity on BNB Chain. Ankr's own report described 60 trillion aBNBc minted across six transactions from a single address, after which the token's price fell more than 99 percent. Ankr put its loss at approximately $5 million in BNB and said it would buy back that amount to cover affected liquidity providers.

In an after-action report Ankr said its investigation concluded that a former team member had carried out what it called a combination of a social engineering and supply chain attack, inserting a malicious code package that compromised its private key once a legitimate update was made. Ankr said it was working with law enforcement to prosecute the individual. No charges or arrest have been reported since.

Published figures differ because they cover different scopes. Ankr's own accounting is about $5 million taken from its token. BlockSec and PeckShield, cited by The Record, put the theft at at least $15 million. Separately, a party bought the collapsed aBNBc cheaply, deposited it at Helio Protocol whose price oracle had not updated, borrowed about $16 million in HAY and swapped roughly $15 million into BUSD. The Block, citing BlockSec, described the connected events as about $20 million in total; it has not been publicly established that the same actor did both. Binance chief executive Changpeng Zhao said the exchange froze about $3 million of the proceeds, and around $3 million was sent to Tornado Cash.

Ankr discontinued aBNBc and aBNBb, airdropped a replacement ankrBNB token to holders from a 2 December snapshot and compensated BNB liquidity providers.