WealthManagementV2 hacked, attacker steals 26,414 USDT

The WealthManagementV2 smart contract on the Binance Smart Chain has been hacked. An attacker exploited the contract’s owner rights to steal 26,414 USDT. Security firm SlowMist discovered the attack and published the details.

In brief:

• WealthManagementV2 contract was hacked for 26,414 USDT on BSC
• Attacker gained access via possibly leaked private key of contract owner
• New owner was able to change parameters without restrictions and claim inflated interest

How the attack worked

The attacker managed to take over the owner rights of the WealthManagementV2 contract. This probably happened through a leaked private key. With this control, the attacker could directly set plan parameters without secured delay periods or limits.

The attacker set the period to zero and changed the interest parameters to values above 500 million. By investing and withdrawing funds in a single transaction, he was able to claim artificially inflated interest. In a second transaction, he unlocked these funds and withdrew them from the contract.

Crypto exploits on the rise

This attack is the latest example in a series of security incidents in the DeFi sector. Earlier, Cozy Finance lost $160.000 due to a vulnerability in the smart contract and Notional Finance was hacked for $173 million through an overflow error.

Security researchers advise project developers to better secure owner rights and to set built-in limits in contract parameters. SlowMist, which discovered this attack, helps DeFi projects identify vulnerabilities in their code.