KiloEx hack — April 2025

KiloEx, a multi-chain perpetual futures exchange, was drained on 14 April 2025. Its own post-mortem places the attack transactions between 18:52:27 and 19:40:49 UTC, with preparation on 13 and 14 April, and names the attacker address, funded from Tornado Cash. Early reporting described the incident as price-oracle manipulation and many accounts still label it that way, but KiloEx's post-mortem identifies an access-control failure. Its TrustedForwarder contract inherited OpenZeppelin's MinimalForwarderUpgradeable and failed to override the execute method, leaving it callable by anyone. Through that opening the attacker reached delegateExecutePositions, which verified only that the call came from the trusted forwarder, not that an authorised keeper had supplied the price. That allowed positions to be opened at an arbitrarily low price and closed at an arbitrarily high one within a single transaction. The pattern was repeated on opBNB, Base, BSC, Taiko, B2 and Manta. Figures differ. KiloEx confirmed a $7.5 million loss and suspended the platform; CoinDesk reported the total as about $7 million and described one transaction in which the attacker netted $3.12 million. KiloEx offered a 10 percent white-hat bounty, about $750,000, for return of the remainder and said it would withdraw legal action against the attacker. The attacker accepted. By 18 April KiloEx said it had recovered all of the hacked funds, with the attacker keeping the bounty, and it published a plan compensating traders whose positions were affected during the suspension and paying stakers an additional 10 percent APY.