Hedera confirms exploit on mainnet led to theft of service tokens

Would You like a feature Interview?

All Interviews are 100% FREE of Charge

Hedera, the team behind the distributed ledger Hedera Hashgraph, has confirmed a smart contract exploit on the Hedera Mainnet that led to the theft of several liquidity pool tokens.

Hedera said the attackers targeted a decentralized exchange (DEX) liquidity pool token. This token is code derived from his Uniswap v2 on Ethereum, which was ported for use with his Hedera Token service.

Today, attackers abused the Smart Contract Service code on the Hedera mainnet to transfer Hedera Token Service tokens held by victim accounts to their own accounts. (1/6)

— Hedera (@hedera) March 10, 2023

The Hedera team explained that suspicious activity was detected when attackers attempted to move stolen tokens through a Hashport bridge consisting of SaucerSwap, Pangolin, and HeliSwap liquidity pool tokens. Operators acted quickly to bring the bridge to a temporary halt.

Hedera has not confirmed the amount of tokens stolen.

February 3rd, Hedera upgrade A network for converting Ethereum Virtual Machine (EVM) compatible smart contract code to Hedera Token Service (HTS).

Part of this process involves decompiling Ethereum contract bytecode to HTS where Hedera based DEX SaucerSwap resides I believe The attack vector came from However, Hedera has not confirmed this in its latest post.

Earlier, Hedera successfully shut down network access on March 9th by turning off the IP proxy. The team said it had identified the “root cause” of the exploit and was “working on a solution.”

To prevent attackers from stealing more tokens, Hedera turned off mainnet proxies and removed user access to mainnet. The team has identified the root cause of the issue and is working on a resolution. (5/6)

— Hedera (@hedera) March 10, 2023

“Once the solution is ready, members of the Hedera Council will sign a transaction authorizing the deployment of updated code to the mainnet to remove this vulnerability. It will turn back on and normal activity can resume,” the team added.

Hedera turned off its proxy shortly after discovering the potential exploit, so the team was suggested Token holders check balances on hashscan.io account IDs and Ethereum Virtual Machine (EVM) addresses for their own “comfort”.

All HashPack functionality will be unavailable during this downtime https://t.co/ngaRmg00Zi

— HashPack Wallet (@HashPackApp) March 9, 2023

Related: Hedera Governing Council Buys Hashgraph IP and Open Source Project Code

The price of the network’s token Hedera (HBAR) has fallen 7% since the incident about 16 hours ago, in line with the broader market decline over the past 24 hours.

However, total value locked (TVL) on SaucerSwap decreased by nearly 30% from $20.7 million to $14.58 million over the same timeframe.

The drop suggests that a significant number of token holders acted quickly and withdrew their funds after the initial discussion of potential exploits.

The incident could undermine a major network milestone, with Hedera Mainnet surpassing 5 billion transactions on March 9.

#hedera: 5 billion mainnet transactions!

real deal. real application.Real World #utility. Are you watching?

we are witnessing #DLT Recruitment on an unprecedented scale.

This is just the beginning. pic.twitter.com/n0TbWTJmC0

— Hedera (@hedera) March 8, 2023

This appears to be the first network exploit reported for Hedera since its launch in July 2017.