Nexera hack — August 2024

Nexera, a tokenisation infrastructure project whose NXRA token and Fundrs platform ran on Ethereum, was attacked on 7 August 2024 beginning at 02:10 UTC.

According to Nexera's own post-mortem, attackers ran malicious code on an employee's machine and obtained the credentials used to manage the project's smart contracts. They then transferred ownership of the affected Ethereum contracts to themselves and blocked the team from reassigning ownership or upgrading, before calling an administrative withdraw function to move 47.24 million NXRA out of the contracts. Cyvers detected the transfers and described an address taking ownership of the proxy contract, upgrading it, then using the withdraw admin function to take all the NXRA. Nexera paused the token contract across Ethereum, Avalanche, Arbitrum and Polygon, asked exchanges to suspend trading, and reported the incident to Dutch police at 07:47 UTC the same morning. NXRA fell around 40%.

The figures are disputed and the gap is wide. Cyvers put the loss at $1.8 million, comprising 32.5 million NXRA then worth about $1.23 million plus $555,000 in USDT; earlier Cyvers reporting gave about $1.5 million. Nexera stated that the attackers sold roughly 14.75 million tokens for around $449,000 and that only about $440,000 was effectively compromised, because the team zeroed the remaining 32.5 million NXRA held in the attackers' wallets. Both the gross and net figures are recorded here.

Nexera identified the malware as BeaverTail and said the delivery methods were consistent with state-backed actors. ZachXBT linked the same attacker to earlier compromises including Concentric Finance, Serenity Shield and Reach. No charges have been reported.