StableMagnet hack — June 2021

StableMagnet was a stablecoin automated market maker on BNB Chain. On 23 June 2021 its operators drained it.

The contract's published source code referenced a linked library called SwapUtils, but neither Etherscan nor BscScan verifies linked library code when verifying a contract's source. The deployed library was not the audited one: it contained a backdoor that let the operators withdraw the pooled stablecoins directly, and also let them pull tokens out of any wallet that had granted StableMagnet a spending approval. A prior audit missed this because the auditors reviewed the project's GitHub repository rather than the deployed library bytecode. The technique was flagged publicly by the account rugdocio.

Reported totals differ. Halborn's analysis puts the loss at $27 million; Cointelegraph reported approximately $25 million taken from more than a thousand users. Greater Manchester Police later seized $22.25 million, which reporting at the time described as roughly 90 per cent of the stolen funds.

An anonymous investor who had been about to put money into the protocol traced the operators himself, identifying them as Hong Kong residents who had moved to the Manchester area, and took what he had to Greater Manchester Police. In July 2021 the force's Economic Crime Unit recovered an encrypted USB stick holding $9.5 million in ether, arrested a 23-year-old man and a 25-year-old woman on suspicion of fraud and money laundering, and days later found a further $12.7 million in a cryptographic safety deposit box. Both were released under investigation. By February 2022 police had returned more than four million pounds to 23 verified victims, with 127 further claims from the UK, US, Europe, China, Australia and Hong Kong being validated.