Loss: the attacker realized about 2,378 ETH of profit, commonly reported around 630Kto666K at the time; the protocol was left with an underwater position of roughly 1,099,841 sUSD collateral against 6,796 ETH borrowed
Summary: In bZx’s second February 2020 exploit, the attacker used a 7,500 ETH flash loan from bZx itself to manipulate the sUSD price on the Kyber paths bZx consulted as its oracle, then combined that inflated quote with a much larger fair-value sUSD purchase from Synthetix’s Depot. With more than 1.09M sUSD marked at the manipulated price, the attacker posted the sUSD as collateral in bZx, borrowed 6,796 ETH against it, repaid the flash loan, and walked away with about 2,378 ETH while the protocol inherited the bad debt.
Trigger / entry point:
bZx valued sUSD collateral using Kyber spot pricing, including shallow reserve paths the attacker could move with a few hundred ETH.
The attacker could acquire a small manipulated lot of sUSD from Kyber and then a much larger inventory of fairly priced sUSD from Synthetix’s Depot, letting cheap real collateral be re-marked at an expensive oracle value.
bZx let that inflated collateral value unlock an immediate ETH borrow in the same transaction.
Root cause:
bZx treated a shallow onchain DEX quote as if it were a reliable solvency input for a large collateralized borrow.
The system effectively assumed the manipulated sUSD/ETH price was executable at the scale of the posted collateral.
The fatal design error was not the flash loan. It was letting an attacker print a temporary collateral price and then honor that paper value with real ETH liquidity.
Exploit path:
The attacker executed transaction 0x762881b07feb63c436dee38edd4ff1f7a74c33091e534af56c9f7d49b5ecac15 at Ethereum block 9504627.
Inside the transaction, the attacker flash-borrowed 7,500 ETH from bZx.
The attacker spent 900 ETH on Kyber-routed purchases of sUSD, using both the KyberUniswap reserve 0x31e085afd48a1d6e51cc193153d625e8f0514c7f and the Kyber sUSD reserve 0x4cb01bd05e4652cbb9f312ae604f4549d2bf2c99.
Those trades pushed the quoted sUSD price up to about 0.00899 ETH per sUSD, roughly 2.5x the normal market level according to PeckShield’s analysis.
The attacker then sent 6,000 ETH to Synthetix’s Depot and acquired another 943,837 sUSD at a fairer rate, with about 2,482 ETH refunded because the Depot did not have enough sUSD inventory to fill the entire order.
Now holding just over 1.09M sUSD, the attacker deposited the sUSD into bZx as collateral while bZx still valued it using the manipulated Kyber price.
Against that overstated collateral, the attacker borrowed 6,796 ETH from bZx.
The attacker repaid the 7,500 ETH flash loan using the borrowed ETH plus leftover balance from the earlier steps and kept about 2,378 ETH as profit.
After prices normalized, bZx was left with an underwater loan position because the posted sUSD collateral was never worth the ETH bZx had lent against it.
What the attacker needed to be true:
bZx had to read sUSD value from manipulable Kyber liquidity rather than from a depth-aware or time-averaged oracle.
The referenced sUSD markets had to be shallow enough that 900 ETH of buying pressure could move the quote dramatically.
Synthetix’s Depot had to remain a separate source of sUSD at near-fair value so the attacker could acquire a large collateral inventory without paying the manipulated market price for all of it.
bZx had to let that marked-up collateral unlock a same-transaction ETH borrow before arbitrage normalized the quote.
bZx needed enough liquid ETH available for the overvalued collateral to be monetizable.
Technical anatomy worth remembering:
This was the cleaner oracle-manipulation half of the two famous February 2020 bZx incidents. The first exploit involved unhealthy-position logic around slippage; the second was the canonical manipulated collateral price -> undercollateralized borrow path.
The pump leg and the hoard leg were separate on purpose. The attacker only needed enough Kyber buying to distort the oracle, then sourced most of the sUSD inventory from Synthetix’s Depot instead of paying the pumped market price for the whole collateral stack.
The real value transfer happened when bZx converted manipulated collateral valuation into an actual ETH loan. The oracle venue and the withdrawal venue were different economic surfaces.
The attack is an early demonstration that DEX spot quotes are not merely risky as liquidation inputs; they are catastrophic when used directly for solvency-critical collateral valuation.
Flash loans mattered as capital efficiency, not as the root bug. The exploit logic still reduces to cheaply print a price, then borrow against it before the print fades.
Representative transactions and addresses:
Main exploit transaction: 0x762881b07feb63c436dee38edd4ff1f7a74c33091e534af56c9f7d49b5ecac15
Kyber reserve highlighted in public analysis: 0x31e085afd48a1d6e51cc193153d625e8f0514c7f (KyberUniswap reserve)
Kyber reserve highlighted in public analysis: 0x4cb01bd05e4652cbb9f312ae604f4549d2bf2c99 (Kyber sUSD reserve)
Attacker-funding transactions cited by Quantstamp: 0x7a1da1fa4a53a2aa6991bcae693683cda04e5def136e061c17d1db9a2a962855, 0xcde447dd6f62a9d16fb6d398938355242f93dc6936fc02e09ff5e86aecadaf23
Response / mitigation:
bZx paused the protocol again after the second exploit and the incident became one of the formative examples in the industry’s move away from raw DEX spot pricing for collateral valuation.
The case sharpened the lesson that even if a venue is usually close to fair price, a solvency oracle must be resistant to transient manipulation at the exact size the protocol is willing to honor.
Later oracle design guidance repeatedly cited bZx-style undercollateralized-borrow attacks as the reason to prefer robust constructions, time-averaging, and depth-aware risk limits over instantaneous DEX quotes.
The stronger design lesson is not just use a better oracle. Thin collateral should not receive full same-transaction borrow authority against a much deeper asset pool until venue depth, source independence, and borrow-side caps all say the printed mark is actually defendable.
Three oracle-authority promotions this incident collapsed
1. A thin Kyber sUSD quote could still be printed
The exploitable starting fact was only that bZx’s collateral oracle still looked at shallow Kyber reserve paths the attacker could move with about 900 ETH of buying pressure.
PeckShield’s reconstruction preserved the sharp local number worth keeping in memory: the attack pushed the quoted sUSD value up to about 0.00899 ETH per token, roughly 2.5x normal market levels.
At that stage the attacker had not yet stolen deep ETH liquidity. The first dangerous promotion was only one attacker-shaped sUSD print now exists on Kyber.
2. bZx still promoted that printed quote into canonical collateral truth for a much larger position
The decisive second promotion was that bZx did not limit the manipulated Kyber mark to the thin lot that actually traded on Kyber; it reused that mark as if it described the whole collateral stack.
This is where the two-venue structure mattered. The attacker used the pumped Kyber route to author the expensive solvency number, then sourced most of the actual inventory from Synthetix Depot at a much fairer rate, ending up with just over 1.09M sUSD that bZx still valued using the manipulated Kyber quote.
In other words, the protocol crossed from a bad quote exists to that bad quote now counts as money-good value for all posted sUSD collateral, even though the venue that printed the number and the venue that supplied most of the size were different markets with different economics.
3. That published collateral truth still inherited immediate ETH reserve authority
The final promotion was that bZx did not merely display or checkpoint the bad sUSD mark; it still honored that mark for an immediate borrow against a much deeper ETH balance sheet.
Against the overstated collateral valuation, the attacker borrowed 6,796 ETH, repaid the 7,500 ETH flash loan, and retained about 2,378 ETH in profit while bZx was left with the underwater position.
That is the reusable design split worth preserving: a thin quote can be printed, that quote becomes canonical collateral truth for the whole position, and that accepted truth still deserves immediate reserve-spend authority were three different promotions, and bZx collapsed them into one transaction.
Why this incident matters
It is one of the earliest crisp examples of a collateralized lending protocol honoring a briefly printed onchain price as if it were money-good.
It shows the importance of modeling oracle attacks as a two-venue problem: where price is printed, and where value is withdrawn.
It also illustrates a recurring pattern in DeFi exploits where a protocol’s deepest pool can be drained by manipulating a much shallower market that the protocol trusts for valuation.
It is also a strong negative exemplar for the newer design-layer question when should thin collateral become real borrow power at all?: bZx effectively answered immediately, and that was enough to let a shallow Kyber print unlock deep ETH liquidity.
Pattern tags
Thin-venue oracle print: bZx treated shallow Kyber reserve state as if it were a money-good solvency price for a large ETH loan.
Cross-venue inventory laundering: the attacker only used the manipulated Kyber route to author the expensive mark, then sourced most of the sUSD collateral inventory from Synthetix Depot at a much fairer price.
Same-transaction collateral monetization: the protocol let the printed mark become immediate borrow authority before arbitrage or risk controls could force re-evaluation.
Split truth surfaces: the venue that authored the collateral price, the venue that supplied most of the collateral inventory, and the venue that paid out real ETH were three different balance sheets.
Why the exploit worked
The attack did not require buying the full collateral stack at the manipulated price. That was the real asymmetry bZx missed. The attacker only needed to spend enough on Kyber to make the oracle publish an expensive sUSD mark, then could source most of the actual sUSD inventory from Synthetix Depot near fair value. In other words, the venue that printed collateral truth and the venue that supplied collateral size were not the same market.
Once bZx accepted the inflated Kyber mark, borrow-side controls added almost no distrust of their own. The protocol did not ask whether 1.09M sUSD could really be unwound into ETH at anything close to the price it had just recognized; it simply turned that paper valuation into an immediate 6,796 ETH loan.
That made the exploit a clean print small, source big, borrow deep path. A few hundred ETH of thin-market pressure authored the collateral price, a much larger inventory came from elsewhere, and the protocol then honored the combined position against a deeper ETH balance sheet that the manipulated venue itself could never have supported.
Same-transaction authority completed the theft path. Arbitrage did not need to fail forever; the attacker only needed bZx to accept the distorted collateral mark long enough to release real ETH before the quote normalized.
The durable lesson is therefore broader than spot oracle bad. bZx collapsed three separate questions into one step: a local price print exists, that print still describes liquidation-size collateral value, and that value deserves immediate borrow authority against deep reserves. The exploit worked because the protocol treated all three as the same claim.
Detection and audit pivots
Ask whether the protocol can be fooled by print small, source big: can an attacker move the quoted market with modest capital, then acquire the actual collateral size from a different venue, treasury, mint window, or fixed-price inventory source before borrowing?
Compare manipulated-venue depth with protocol payout depth. If a few hundred ETH can move the oracle but the protocol will honor that mark against thousands of ETH of borrowable liquidity, the solvency boundary is already upside down.
Treat same-block collateral activation as part of oracle design. If freshly printed collateral can unlock immediate borrowing, the attacker does not need the bad price to survive long enough for honest liquidators to notice.
Model the attack as three surfaces, not one: where the price is authored, where collateral size is accumulated, and where deep-liquidity value is withdrawn.
Failure-prevention checklist
Do not let a shallow spot quote define full collateral value for a deep borrow market. If the venue cannot absorb liquidation-size unwind, its price should be haircut, capped, delayed, or ignored for solvency.
Treat price venue and inventory venue as separate risk objects. If a borrower can print the mark on one market and source most of the collateral from another venue at a fairer price, collateral policy must defend against that cross-venue laundering path.
Quarantine newly admitted or thin collateral behind small borrow caps and delayed activation until independent executable depth exists.
Refuse same-transaction collateral monetization for assets whose borrow power depends on fast-changing local spot markets or fresh cache reads.
Make oracle design depth-aware, not just numerically current. A mark that is accurate for a tiny swap but absurd for liquidation size is already a bad lending oracle.
Couple collateral listing, oracle selection, collateral factors, and ETH-liquidity exposure into one risk decision. bZx failed because all four were effectively loosened at once for sUSD.
Monitor where strong-asset reserves can be drained by weaker-market marks. If the deepest pool in the system can be borrowed against the thinnest market the protocol reads, the payout surface is mis-sized.
Treat protocol treasuries, fixed-price depots, mint windows, or redemption facilities as collateral-sourcing venues in threat modeling. They can let attackers scale inventory far beyond the manipulated market itself.
Audit prompts
What exact market state gave sUSD borrow authority here: a Kyber route, a reserve-weighted path, a single pool, or some composed quote, and how much capital did it really take to move that state?
Could the borrower print the oracle on one venue, then source most of the posted collateral somewhere else without paying the manipulated price for the whole position?
What would bZx actually have recovered if it had to liquidate 1.09M sUSD collateral into ETH at the moment the loan was opened?
Did the protocol distinguish between quoted price exists and protocol can safely lend thousands of ETH against that price right now, or were those treated as the same claim?
Could fresh collateral become borrowable in the same transaction or same short window that authored the price?
Were collateral factors, borrow caps, and oracle choice sized against executable market depth, or copied from an assumption that a dollar-stable asset was automatically deep enough?
If the primary quoted venue became unavailable, thin, or obviously distorted, what control would have narrowed borrowing authority before the loan path stayed live anyway?
What other venues, depots, treasuries, or protocol-native inventories could have let a borrower scale a manipulated-collateral position far beyond the depth of the printed market?
Lessons that should already be standard
A solvency oracle is not the place a token last traded; it is the place the protocol could actually unwind collateral at the size it is willing to honor.
Thin stablecoin markets are still thin markets. Stable in branding does not rescue shallow liquidity or make a spot quote safe for deep borrowing.
Same-transaction borrowing is a policy choice, not a neutral convenience. If a printed mark can be consumed before arbitrage repairs it, the protocol has effectively delegated credit authority to the attacker.
Cross-venue attacks matter because price discovery and inventory acquisition are often different systems. Risk models that look only at the quoted venue miss the real scaling path.
Flash loans make oracle abuse cheaper, but the root bug is still honoring paper collateral value with real reserves. Removing flash loans would not have repaired the lending design.
The right response to thin collateral is often boring and restrictive: lower caps, higher haircuts, delayed activation, or no borrowability at all until depth becomes real.
The deepest liquidity in a protocol should not be reachable through its weakest price surface. If that routing exists, the system is already asking to socialize bad debt.
Positive-design companion: collateral-admission-lag-and-borrow-side-quarantine — the sharper follow-up when the question becomes why thin or newly stressed collateral should not receive full borrow authority the same moment a locally printable mark appears.
Oracle-design companion: oracle-independence-inventory-and-degraded-mode-discipline — useful when the sharper question is how a lending market should inventory whether its quoted collateral price really comes from independent executable depth or from one shallow venue family speaking for the whole market.
Timing-side companion: delayed-snapshots-and-same-block-quarantine — useful when the sharper question is why a price that can be printed and consumed in one transaction should never become immediate solvency truth.
The leverage sat in bZx’s oracle-source choice, collateral-valuation rules for sUSD, same-transaction borrowability, and the assumption that a shallow Kyber quote could safely stand in for realizable collateral value.
Just as important, the protocol collapsed three policy decisions into one step: whether the quoted sUSD mark was trustworthy, whether that mark was executable at the scale of the posted collateral, and whether the resulting credit should be borrowable immediately against deep ETH reserves.
bZx did not merely have a flash loan problem. It had a solvency-design problem: the protocol treated a cheaply manipulated market print as good enough to unlock real ETH from the lending pool.