KiloEx Hit by $7M Exploit

KiloEx, a decentralised exchange (DEX) running on Arbitrum, suffered a major security breach early Monday, losing more than $7 million in an apparent oracle manipulation attack. The incident has rattled confidence in smaller DeFi platforms and reignited the debate over the safety of price feeds in leveraged trading protocols.

What Went Down

According to on-chain sleuths and blockchain security firms like PeckShield and Cyvers, the attacker exploited a flaw in KiloEx’s smart contracts tied to its price oracle system. By manipulating pricing data, the attacker was able to inflate asset values and drain user funds through bad debt positions.

The exploit originated from a smart contract created just hours before the attack. Blockchain data shows the attacker successfully withdrew funds and began moving them through mixing services, including Tornado Cash, shortly after the hack.

Price Oracles Under Fire

Oracle manipulation isn’t new, but it remains one of the most damaging attack vectors in DeFi. DEXs like KiloEx, especially those offering high-leverage trading, rely heavily on accurate and secure oracle data. When this layer breaks, the results can be catastrophic.

PeckShield reported that the root cause was a coding error in how KiloEx handled price feeds. Once the attacker manipulated the price, they executed leveraged trades that tricked the system into allowing uncollateralized positions, siphoning off millions.

Cyvers’ analysis noted that the funds are now mostly laundered, making recovery unlikely unless the attacker chooses to return them — a scenario that’s become more common lately with so-called “white-hat” hackers.

Arbitrum’s Growing Pains

The incident places a spotlight on Arbitrum’s rapidly growing DeFi ecosystem. While it’s been praised for low fees and high-speed transactions, some platforms on the network may be cutting corners on security.

KiloEx has since paused trading, and its team says they’re investigating and working on a compensation plan for affected users. But the damage to its reputation might be harder to fix than the smart contracts themselves.

KiloEx isn’t the first DEX to fall victim to oracle games, and it won’t be the last. But with $7 million gone, it’s a harsh reminder for developers and users alike: in DeFi, one flawed line of code can erase everything.