Orion Protocol hack — February 2023

On 2 February 2023 an attacker took about $3 million from Orion Protocol, a liquidity-aggregating trading platform. CoinDesk reported initial estimates from on-chain analysts putting the split at roughly $2.8 million on Orion's Ethereum implementation and $200,000 on its BSC implementation. PeckShield first flagged the transactions, noting that the protocol was being paused as it reported. The attack was a reentrancy exploit. The attacker deployed a fake ERC-20 token, borrowed stablecoins through a flash loan, and routed a swap through that token. Because the fake token's transfer function called back into Orion's exchange contract, the attacker could re-enter and invoke depositAsset in the middle of the swap, so the deposited assets were counted twice; the inflated internal balance was then withdrawn. CertiK, analysing the vulnerable contract, described "a reentrant call to deposit tokens during the swap, thus causing the deposit tokens to also be counted in the swap process". DailyCoin, reporting Orion's post-mortem, put the flash loan at 284,700 USDT. Orion paused deposits. Chief executive Alexey Koloskov said no user experienced any loss and listed staking, the Orion Pool, the bridge, liquidity providers and depositless trading as secure, with the exploit contained to an internal broker account. He attributed the vulnerability to a mix of third-party libraries rather than Orion's core code, and said future contracts would be built in-house. CertiK noted that the compromised contract was not audited by CertiK, which had audited only Orion's token and sale contracts. Most proceeds were routed through Tornado Cash; roughly $1 million in ETH remained in the attacker's Ethereum address at the time of Orion's post-mortem. Published figures consistently say about $3 million and no more precise total has been released.