Bifrost Liquidity Pool Hacked for $720,000
Bifrost monitoring shows that on August 8 at 19:47 Beijing time, hackers exploited a vulnerability in the liquidity pool to steal approximately $720,000 in assets from the vDOT single currency pool and the vASTR/ASTR and vMANTA/MANTA pools.
About 881,150 DOT were transferred, ultimately flowing into Binance via HitBTC; Bifrost has submitted a freeze request to Binance and provided on-chain evidence to law enforcement, while also halting all liquidity mining rewards and conducting a comprehensive security review.
Funds circulated through centralized exchanges, and under the pressure of the incident, the principal of the affected pools was withdrawn. The protocol urgently suspended mining, and exchanges and law enforcement channels benefited from the potential recovery, while users and the protocol faced pressure.
Source: Public Information
ABAB AI Insight
Bifrost, as a liquidity and staking derivatives protocol in the Polkadot ecosystem, previously focused on cross-chain vToken and yield layer development, handling cross-chain and bridging risks multiple times; this vulnerability is concentrated in the shared vault reward amplification mechanism for mining incentives, exposing accounting boundary issues in incentive design.
Funds were directly withdrawn from the shared vault through abnormal reward amplification and quickly crossed chains to exchanges, motivated by exploiting incentive calculation vulnerabilities for unauthorized principal withdrawal; similar paths can be seen in other DeFi protocols where gauge or reward distribution contracts have been exploited.
In light of recent DeFi liquidity mining and shared vault attacks, we are currently in a phase of strengthening security audits and real-time monitoring of incentive contracts.
This essentially belongs to a contract logic vulnerability in technical replacements: the reward amplification mechanism did not adequately constrain principal boundaries, and the mechanism is too tightly coupled with the shared vault and incentive calculations, leading to a single anomaly that can deplete pool assets.
ABAB News · Cognitive Laws
The more complex the incentive design, the greater the vulnerabilities
Shared vaults are the preferred entry point for attacks
Rapid cross-chain is a standard path for hackers