Skip to content

Polkadot-ecosystem platform Polkatrain loses $3 million in a rebate arbitrage attack

Polkadot-ecosystem platform Polkatrain loses $3 million in a rebate arbitrage attack

On April 5, 2021, Polkatrain, a decentralized fundraising platform operating in the Polkadot ecosystem, suffered a rebate arbitrage attack resulting in the loss of $3 million.

The attack was detected by blockchain ecosystem security platform SlowMist, indicating that the hack targeted Polkatrain contract with swap functionality and rebate mechanism dubbed POLT_LB. 

The analysis adds that the attackers took advantage of the flaws in the system’s update function. 

In this case, when users purchase the Polkatrain native token PLOT, they are eligible for a certain amount of rebates. The system’s design sends the rebates through the transfer function, where the update function takes over.

SlowMist explains the flaws in the update function that the attackers explored. According to the cybersecurity company: 

“Since the update function does not set the maximum amount of rebates in a pool, nor does it determine whether the total used up rebates, malicious arbitrageurs can continue to call the swap function to exchange tokens to get the contract,” SlowMist said. 

Polkatrain confirms hack

Elsewhere, Polkatrain in a statement confirmed the incident stating that it will follow up in the coming days.

“Polkatrain team has identified and verified that the hacking incident is a malicious attack by hacker, he used the problem similar with slippage tolerance,” Polkatrain said. 

The platform revealed that the name of the hacker has already been identified as Mr. Jiang.

Interestingly, Polkatrain did not specify the amount lost through the hack. Furthermore, the platform urged the hacker to return the stolen funds or risk arrest from authorities in China. 

The attack contributes to the total cumulative funds lost in blockchain hacks, with SlowMist placing the total figure around $14.5 billion. 

Best Crypto Exchange for Intermediate Traders and Investors

  • Invest in 70+ cryptocurrencies and 3,000+ other assets including stocks and precious metals.

  • 0% commission on stocks - buy in bulk or just a fraction from as little as $10. Other fees apply. For more information, visit etoro.com/trading/fees.

  • Copy top-performing traders in real time, automatically.

  • eToro USA is registered with FINRA for securities trading.

30+ million Users
eToro is a multi-asset investment platform. The value of your investments may go up or down. Your capital is at risk. eToro USA LLC does not offer CFDs, only real Crypto assets available. Don’t invest unless you’re prepared to lose all the money you invest.

Read Next:

Weekly Finance Digest

By subscribing you agree with Finbold T&C’s & Privacy Policy

Related posts

Disclaimer: The information on this website is for general informational and educational purposes only and does not constitute financial, legal, tax, or investment advice. This site does not make any financial promotions, and all content is strictly informational. By using this site, you agree to our full disclaimer and terms of use. For more information, please read our complete Global Disclaimer.