ChainCatcher news, Web3 infrastructure provider Ankr has released an attack incident report, revealing the findings of an investigation into the exploitation of the aBNBc Token vulnerability. Ankr stated that this attack originated from a former team member who maliciously conducted a supply chain attack by inserting a malicious code package, which could compromise private keys once a legitimate update was performed. Currently, Ankr is working with law enforcement to prosecute this former team member to bring them to justice.Ankr indicated that this could affect any protocol, and the team is supporting internal human resources processes and security measures to strengthen future security posture. Ankr is implementing several improvements to its security status, including requiring all updates to undergo multi-signature authentication and time-locks, enhancing internal security measures, implementing new monitoring and notification systems, and refining the process of using DeFi protocols. (Source link)

ChainCatcher message, Ankr officially announced that starting today, it will airdrop ankrBNB to all aBNBc and aBNBb holders (wallets only, excluding smart contracts holding these tokens). Users holding aBNBc and aBNBb through smart contracts are expected to receive the airdrop tomorrow. Ankr has currently locked the transferability of ankrBNB to ensure a fair launch, which is expected to be unlocked by Friday evening (PST).The announcement states that users who redeem aBNBc or aBNBb (unstake) before the exploit will receive BNB at the end of the unbinding period. Users who redeem aBNBc or aBNBb after the exploit will not receive BNB at the end of the unbinding period and will receive ankrBNB airdrop. (source link)

ChainCatcher news, the stablecoin protocol Helio Protocol in the BNB Chain ecosystem tweeted an update on the latest progress of the HAY peg recovery plan, stating that the team has initiated the process of peg recovery, which is expected to be completed by December 6. The official team will buy back excess HAY from the market and send it to a burn address to restore the HAY peg.In addition, Helio Protocol has committed to using its current and future revenues to cover any remaining bad debts. Coinmarketcap data shows that the price of HAY has rebounded to $0.8971.It is reported that after the aBNBc token attack incident of Ankr on December 2, HAY once depegged to $0.2084. Helio Protocol stated the next day that Ankr may bear the bad debts caused by the hacker attack. (source link)

ChainCatcher message, Ankr posted an explanation for the halt of aBNB trading: "The DEX itself does not have the ability to stop trading, so Ankr advises liquidity providers to remove liquidity from the liquidity pool. Ankr will absolutely not follow the solution of LUNA. After the new ankrBNB Token airdrop, aBNBc and aBNBb will be worthless. ankrBNB will be the only token that can be exchanged for staked BNB (not affected by the exploit).Therefore, Ankr advises all liquidity providers to remove aBNB to avoid speculative trading, as DEXs typically cannot stop trading capabilities, and Ankr cannot prevent speculative trading or control other DeFi protocols." Ankr also stated that its team is working around the clock to compensate users affected by the previous hacking incident.In previous news, on December 2, Ankr announced that it would take a snapshot and reissue ankrBNB to users who held aBNBc before the attack, and purchase $5 million worth of BNB to compensate LPs. Ankr also stated that the project will use reserves to compensate aBNBc liquidity providers and has begun collecting a list of affected individuals. (source link)

ChainCatcher news, Ankr posted on social media that the project will use reserves to compensate aBNBc liquidity providers and has begun collecting a list of affected individuals. All staked assets on Ankr Staking are safe, and infrastructure services are unaffected. Furthermore, Ankr stated that they are aware of speculative trading occurring after the hacking incident, but compensation can only be provided to liquidity providers. (source link)

ChainCatcher message, the Ankr team released 4 instructions, including: 1. Do not trade; 2. If you are a liquidity provider and hold aBNBc tokens, please remove liquidity from the DEX; 3. Ankr will take a snapshot, users can wait for further messages; 4. aBNBc will be reissued. (source link)

ChainCatcher news, the stablecoin trading platform Wombat Exchange announced on Twitter that it has suspended the BNB pool, as well as the exchanges for BNB, BNBx, stkBNB, and aBNBc. Deposits and withdrawals have also been suspended. Previously, Wombat had suspended the aBNBc pool and the HAY pool.According to earlier reports, Beosin monitoring showed that after the Ankr aBNBc was attacked, there was an arbitrage opportunity due to the exchange rate of WBNB and aBNBc on Wombat being approximately 1:1, which led to the depletion of WBNB liquidity. Currently, the arbitrage address (0x20a..76f) has made a profit of about $2 million. (Source)

ChainCatcher news, according to monitoring by Beosin's Beosin EagleEye, due to a private key leak attack on the Ankr Staking: aBNBc Token project, a large amount of aBNBc was minted, which affected the prices of WBNB and aBNBc in the pair (0x272c...880). The exchange rate of WBNB and aBNBc in the Wombat project is approximately 1:1, creating an arbitrage opportunity, and the WBNB liquidity has been drained. Currently, the arbitrage address (0x20a..76f) has profited about 2 million USD, and Beosin Trace will continue to monitor the stolen funds.

ChainCatcher message, BNB Chain tweeted that it has noticed the attack on the Ankr aBNBc contract this morning, and the attacker's address has been blacklisted.According to previous news, on-chain data shows that the anonymous arbitrageur involved in the Ankr attack has transferred over 15.5 million BUSD to Binance. (source link)

ChainCatcher news, according to PeckShield analysis, the Ankr aBNBc token contract has an infinite minting vulnerability. Although the mint() function is protected by the onlyMinter modifier, there is another function (with the 0x3b3a5522 func.signature) that can completely bypass caller verification to achieve infinite minting.In addition, the Ankr attacker created a token called Fuck BNB and provided 15 ETH to establish a liquidity pool for it on Uniswap V2. (source link)

ChainCatcher news, Ankr stated on its official social platform that its aBNB has been stolen, and it is currently cooperating with trading platforms to immediately halt trading.According to previous reports, Shield monitoring indicated that the Ankr protocol was suspected of being attacked, with hackers minting approximately 20T aBNBc and selling it through PancakeSwap, causing the aBNBc price to plummet. The hackers have successfully withdrawn over 5 million USDC. (source link)