Qubit
HackedDeFi · born 2021 · ✝ 2022
Minted infinite collateral from a deposit that never happened.
Qubit was a cross-chain lending protocol on BNB Chain with a bridge to deposit assets from Ethereum. In 2022 an attacker exploited its deposit logic to credit collateral without sending funds, draining roughly $80M.
- Peak
- ~$80M stolen
- Cause
- Hacked
- Year of death
- 2022
☠️ Cause of death
A flawed transfer/deposit function let the attacker register a phantom deposit, mint xETH collateral, and borrow against it to empty the protocol's reserves.
📓 Lessons left behind
- —Validate that deposited assets actually arrived before crediting collateral.
- —Bridge deposit logic deserves the harshest adversarial testing.
- —A single accounting flaw can mint unlimited fake collateral.
🌱 The idea that survived
Verified bridge deposits
Pushed bridges to cryptographically confirm inbound transfers before minting any representative collateral.
#defi#bridge#lending#bsc