Nexera Hacked for $1.5 Million as Hackers Target DeFi Protocols

Nexera, a DeFi protocol, was hacked for $1.5 million on August 7, according to blockchain security firm Cyvers. It revealed the exploit in an X post

DeFi protocol Nexera was hacked for $1.5 million on August 7, blockchain security firm Cyvers revealed in an X post on Monday.

"Hey @Nexera_Official,

Our system has detected a suspicious transaction involving your proxy contract.

An address took ownership of your proxy contract and upgraded it. Shortly after, the address used the withdraw admin function to transfer all the $NXRA tokens."

Nexera connects DeFi with traditional finance, enabling the tokenizing of real-world and digital assets for on-chain benefits. In this case, the hacker managed to hijack Nexera’s contracts and alter them to withdraw $1.5 million worth of NXRA, the platform’s native tokens.

Following the hack, the bad actor traded the stolen NXRA for ETH in order to mask their tracks. Hackers often convert stolen assets to ETH to access mixer services like Tornado Cash that work to obfuscate its users’ fund flows, thereby letting criminals get away with their ill-gotten proceeds. This hacker has also bridged the ETH to the BNB chain.

Cyvers added, "The address is currently selling all the tokens for $ETH, and some of the funds have already been bridged to the $BNB chain."

But the story doesn’t end there. On-chain data reveals this exploit was not the hacker’s first rodeo. Transaction history from their wallet reveals that they are associated with multiple exploits from the past.

Blockchain sleuth ZachXTB uncovered the fact, "Attacker is connected on-chain to recent private key compromise incidents such as SpaceCatch, Concentric Finance, OKX DEX, Serenity Shield, Reach, and many more."

This marks yet another hack in a series of such incidents that have occurred recently. For instance, numerous successful attacks took place last month.

WazirX was the victim of a $230 million exploit, Convergence was exploited for $212,000, and LI.FI had over $11 million drained from its contracts.