10 Quick and Dirty Facts about the bZx Hacks

Quantstamp Announcements
Share this article:

10 Quick and Dirty Facts about the bZx Hacks


These facts are brought to you by Quantstamp, a leading DeFi security company. 

#1  The 1st hack used Tornado Cash to stay anonymous (source)

#2  The 2nd hack used ShapeShift to stay anonymous (source 1) (source 2) . 

#3  Both hacks were each carried out in a single atomic transaction (attack 1) (attack 2).

#4  5 money legos and over 25 contracts were used in the 1st hack (source).

The first hack interacted with 5 different protocols (Kyber, Uniswap, dYdx, bZx and Compound) and over 25 smart contracts; this highlights the massive composability of these money legos. This all took place in a single transaction.  

#5  Flash loans were used in both hacks, but they worked as intended. 

Flash loans were never exploited. Their purpose in the attacks were to provide the attackers with enough capital to produce massive slippage in low liquidity DEX markets.  

#6  The 1st attack was not an oracle attack. 

Uniswap was targeted in the 1st attack, but Uniswap was targeted because it was vulnerable to slippage, not because it was used as a price oracle. 

#7  The 2nd bZx attack was an oracle attack. 

bZx made the mistake of calculating the value of collateral within their system using DEX price oracles. The attacker took advantage of this by causing massive slippage in sUSD DEX markets in order to temporarily inflate the value of sUSD calculated within the bZx system. Once the attacker took out the loan, the position was instantly “underwater” because of the inflated value of the collateral. 

#8  Each hack left an underwater position open in bZx. 

A loan is underwater when the value of the collateral is not enough to cover the outstanding debt of the loan. The 1st bZx hack instantly left a position underwater by approximately 640,000 USD worth of cryptocurrency. The 2nd bZx hack instantly created a position that was underwater by approximately  800,000 USD. 

#9  bZx’s flash loan was used in the 2nd hack  

In the second attack, the attacker used bZx’s flash loan feature. The first attack used dYdX’s flash loan feature.

#10  These hacks may have been conducted by two different people. 

There is no evidence that these attacks were conducted by the same person. 

--

For more Quantstamp news or anything QSP crypto or QSP coin related, check out Quantstamp Reddit and QSP Twitter.



Back
Quantstamp Announcements

July Security Beat: Keys Over Code (Again?)

Crypto lost more than $240 million across 29 incidents in July 2026, up roughly 216% from June's $75.87M, even as the number of attacks fell from 40 to 29. For the second month running, the damage didn't come from clever contract exploits. The same failure class ran through Web2, from a $12.3M rail-industry ransom to a 1TB bank breach that started with one employee's email. Here's the month in security 👇

Read more
Quantstamp Announcements

June Security Beat: Keys Over Code

$75.32M was lost across 32 crypto incidents in June, up from May's $59.52M. No coordinated campaign carried the month, but one targeted operation did. A targeted social-engineering attack against Humanity Protocol reached the keys behind the $H token and drained $32M, roughly 42% of every dollar lost in June. Quantstamp led the independent investigation and traced the tooling to a phishing campaign previously seen targeting macOS users. Offchain, a fresh npm supply chain wave hit Red Hat's packages on the first day of the month, and a PeopleSoft zero-day was exploited for two weeks before Oracle said a word. Here's the month in security 👇

Read more
Quantstamp Announcements

May 2026 Security Beat

$59.52M was lost across 29 crypto incidents, down sharply from April's ~$635M. No single hack carried the month. The bigger story happened off-chain, where a self-propagating npm worm called Mini Shai-Hulud kept resurfacing in new waves through the month, ultimately spanning more than 1,000 malicious package versions across the npm ecosystem.

Read more