Kyber Network / KyberSwap (2023) — Crypto Hack
LaunderedKyberSwap's concentrated liquidity pools were drained of $49M via a sophisticated exploit targeting edge cases in the tick-crossing math.
Summary
KyberSwap's concentrated liquidity pools were drained of $49M via a sophisticated exploit targeting edge cases in the tick-crossing math.
How It Was Compromised — DeFi via Smart Contract Exploit
The attacker identified and exploited a precise mathematical edge case in KyberSwap's concentrated liquidity tick-crossing logic. By carefully constructing swaps that crossed specific tick boundaries in a particular order, the attacker could manipulate the virtual liquidity calculation to extract more tokens than deposited. The exploit required deep mathematical understanding of AMM tick mechanics.
Fund Flow & Laundering Analysis
Stolen assets moved through bridges across multiple chains to consolidate on Ethereum. The attacker posted an on-chain ultimatum demanding control of KyberDAO and Kyber's companies in exchange for a 90% fund return. After negotiations failed, funds were routed through Tornado Cash. KyberSwap suspended operations and laid off staff post-hack.