Boy X Highspeed Incident Analysis

리서치 사고 분석
Boy X Highspeed Incident Analysis

BSC Daily News tweeted out an alert stating that BXH has rugpulled for $12.5 million. This number cannot be independently verified at this time.

However, CertiK has analyzed on-chain data and can confirm that the externally-owned account (EOA) 0xafc6e88c90334618e73eadc04b0f9dc0482f7be3 repeatedly invoked the privileged function InCaseTokensGetStuck() on the project’s staking pool contracts on BSC, Avalanche, and HECO Chain.

BXH Code Snippet

At present, it appears as though the funds have been aggregated on the Ethereum mainnet, for a total of $2,433,665.79 or ~1,865 ETH. The attacker bridged a total of 1,228.73 ETH from BSC to Ethereum, 267.34 ETH from Avalanche to Ethereum, and 105.49 ETH from HECO Chain to Ethereum. This address has since sent the funds to Tornado Cash to be laundered.

The affected contracts were deployed in May 2022. This exploit began on September 20 and the stolen funds began to be sent to Tornado Cash on September 23.

The BXH team released a statement saying that they were “deeply sorry for the recent security incident.” The statement outlined a path forward for the project, without detailing how affected users would be reimbursed for their losses.

A Telegram channel has been set up to provide affected users with a place to discuss the ongoing event. An unverified document has been posted in the channel which appears to be a press release in Chinese stating that BXH fell victim to a phishing scam, there is no fault on the part of the team, and they are cooperating with police.

BXH was not audited by CertiK. The “emergency function” InCaseTokensGetStuck() would have been flagged as a severe centralization risk in an audit. Functions such as this are a risk on multiple levels. They give privileged accounts the ability to drain affected contracts of all funds, which opens the door to malicious insiders taking advantage of this power, while also providing a prime target for phishers.

관련 블로그

Verus Incident Analysis
리서치 ·사고 분석

Verus Incident Analysis

On July 23, 2026, an attacker exploited the Verus Protocol’s Ethereum cross-chain bridge, draining approximately $7.44 million in ETH, tBTC, stablecoins, and MKR. The attack relied on a discrepancy in how Verus and Ethereum interpreted notarization data: malicious duplicate state-root entries were included in otherwise legitimate notarizations, signed by Verus notaries, and then relayed to Ethereum, where they overwrote the genuine trusted state root.

DefiTuna Incident Analysis
리서치 ·사고 분석

DefiTuna Incident Analysis

On 16 July 2026, DeFiTuna was exploited for approximately $569,601 USDC on Solana. The attackers created a highly illiquid TUNA/USDC pool and used it as the destination for borrowed USDC routed through Jupiter. Because the swap returned only a negligible amount of TUNA, DeFiTuna’s value calculation rounded the position’s total assets down to zero. The protocol then incorrectly treated the position as healthy, allowing the attackers to bypass the solvency check and withdraw the USDC through attacker-controlled liquidity positions.

GnosisPay Incident Analysis
리서치 ·사고 분석

GnosisPay Incident Analysis

On 01 June 2026 an attacker drained dozens of GnosisPay Safes on Gnosis Chain. The attack vector was a signature-verification flaw in the GnosisPay Delay module.