OAK — OnChain Attack Knowledge

Worked example · 2022-12

Ankr aBNBc Liquid Staking Token Exploit via Unlimited Mint — BNB Chain — 2022-12-02

Loss
approximately $5M–$7M in extracted value. The attacker exploited a vulnerability in Ankr's aBNBc token contract (the liquid staking derivative for BNB staked through Ankr on BNB Chain) to mint approximately 10 trillion aBNBc tokens — effectively unlimited — by calling a privileged function with attacker-controlled parameters. The attacker converted the minted aBNBc to other assets via PancakeSwap and other BNB Chain DEX pools, extracting BNB and stablecoins before the aBNBc price collapsed to near-zero.
OAK Techniques observed
OAK-T14.004 (Liquid Restaking / Liquid Staking Token Pricing Manipulation — the exploit collapsed aBNBc's market price by flooding the DEX with attacker-minted supply, imposing near-total losses on legitimate aBNBc holders who held the token as a representation of staked BNB. The pricing surface is structurally identical to the T14.004 mechanism: a liquid staking token's secondary-market price was manipulated through a supply-side exploit.) OAK-T9.004 (Access-Control Misconfiguration — the root cause was a privileged-function access-control vulnerability in the aBNBc contract that allowed the attacker to call a mint function meant for the Ankr deployer.) OAK-T14.003 (LST/LRT Depeg Cascade — structurally adjacent; the aBNBc exploit is a single-asset LST depeg triggered by a contract exploit rather than by a withdrawal-queue or redemption-constrained mechanism.)
Attribution
inferred-strong — operator-attributed insider. Ankr's post-mortem attributed the exploit to a former team member who compromised the deploy key via a supply-chain / social-engineering path; the on-chain extraction address is public but not linked to a named individual, and there is no confirmed law-enforcement arrest in the public record. Ankr publicly acknowledged the exploit and committed to compensating affected users. (Attribution consistent with the companion file examples/2022-12-ankr.md.)
Key teaching point
The aBNBc exploit is the canonical cross-chain LST pricing-surface anchor: the T14.004 mechanism operates on any chain where a liquid staking token's price can be manipulated through the token's smart-contract surface, regardless of the underlying chain's consensus mechanism. While the canonical T14.004 cases concentrate on Ethereum/EigenLayer LRT depegs (ezETH, eETH, rsETH, pufETH), the aBNBc case demonstrates that the surface is chain-agnostic: the attack vector is the liquid staking token's smart-contract surface, and the extraction channel is the DEX liquidity pool where the LST trades against the underlying asset. The structural lesson is that an LST's smart-contract access-control surface is a first-class T14.004 risk dimension — a mint-function vulnerability converts directly into LST price collapse because the attacker can mint unlimited supply and dump it on the DEX before the market can absorb the information.

Summary

Ankr is a multi-chain staking and node-infrastructure protocol. On BNB Chain, Ankr operated aBNBc (Ankr BNB), a liquid staking token representing staked BNB. Users deposited BNB into Ankr's staking pool and received aBNBc in return; aBNBc could be held to accrue staking rewards or sold on PancakeSwap and other BNB Chain DEXes to exit the BNB staking position.

On December 2, 2022, an attacker exploited a vulnerability in the aBNBc token contract. The contract contained a privileged mint function intended for the Ankr deployer address; due to an access-control misconfiguration, the function was callable by any address. The attacker called the mint function and "minted" approximately 10 trillion aBNBc tokens to their own address.

With the attacker-minted aBNBc supply, the attacker executed the standard exploit chain:

  1. DEX dump. The attacker deposited massive quantities of aBNBc into PancakeSwap and other BNB Chain DEX liquidity pools, swapping aBNBc for BNB, USDC, USDT, and other assets.

  2. Price collapse. The sudden supply flood collapsed aBNBc's market price from ~$300 (near BNB parity at the time) to near-zero within minutes. Legitimate aBNBc holders who held the token as a representation of their staked BNB suffered near-total losses on their holdings.

  3. Bridge-out and launder. The attacker bridged the extracted BNB and stablecoins to Ethereum and routed through Tornado Cash — the canonical T7.001 extraction-to-mixer chain.

  4. Ankr compensation. Ankr publicly acknowledged the exploit, paused aBNBc operations, and committed to compensating affected users (estimated $5M–$7M in total losses) through a combination of protocol treasury funds and a reissued ankrBNB token.

The exploit is structurally instructive for T14.004 because the pricing surface was the aBNBc/BNB DEX pool: the attacker did not manipulate the pool directly (e.g., via flash-loan oracle manipulation as in T9.001) but instead minted unlimited aBNBc supply and dumped it into the pool, collapsing the price. The aBNBc smart-contract surface (mint-function access control) was the load-bearing vulnerability; the DEX pool was the extraction channel. This smart-contract→pricing collapse chain is the cross-chain generic form of T14.004: any LST with a vulnerable mint/burn/transfer surface can have its market price collapsed by an attacker who exploits that surface and dumps the resulting supply on the LST's DEX market.

The case is the largest BNB Chain LST exploit and anchors T14.004 at the non-Ethereum layer. Combined with the Ethereum/EigenLayer LRT depegs (ezETH, eETH, rsETH, pufETH) and the cbETH structural discount, the aBNBc exploit completes the cross-chain T14.004 spectrum: Ethereum LRT event-driven depegs, Ethereum LST structural discount, and BNB Chain LST smart-contract-exploit-driven collapse.

Timeline (UTC)

When Event OAK ref
pre-2022-12 Ankr aBNBc deployed on BNB Chain; mint function access-control misconfiguration present from deployment T9.004 (standing vulnerability)
2022-12-02 Attacker calls privileged mint function; mints ~10 trillion aBNBc tokens T9.004 + T14.004
2022-12-02 Attacker dumps aBNBc on PancakeSwap and BNB Chain DEXes; aBNBc price collapses from ~$300 to near-zero T14.004 (supply-flood price collapse)
2022-12-02 Attacker bridges extracted assets to Ethereum; routes through Tornado Cash T7.001 (laundering)
2022-12-02 Ankr acknowledges exploit; pauses aBNBc; commits to user compensation (~$5M–$7M) (incident response)
2022-12 onward Ankr reissues ankrBNB as replacement liquid staking token; aBNBc deprecated (remediation)

Public references

  • Ankr official post-mortem and compensation announcement (December 2022)
  • Peckshield on-chain analysis of aBNBc mint and DEX dump transactions
  • BNB Chain / PancakeSwap pool analytics showing aBNBc price collapse
  • See techniques/T14.004-liquid-restaking-token-pricing-manipulation.md for Technique definition

Discussion

The aBNBc exploit extends the T14.004 surface from the Ethereum/EigenLayer LRT ecosystem to the BNB Chain LST ecosystem, demonstrating chain-agnosticism. The mechanism — exploit the token's smart-contract surface to create supply-side manipulation, dump on the DEX, extract the underlying asset — is structurally identical regardless of the chain or the specific LST. The only chain-specific variable is the DEX depth available for the dump.

The case bridges T14.004 (LST pricing manipulation) and T9.004 (access-control misconfiguration) at a single well-documented incident: the access-control vulnerability is the T9.004 root cause; the LST price collapse and holder losses are the T14.004 outcome. The combined T9.004 + T14.004 chain is the canonical illustration of how smart-contract access-control surfaces compound into LST pricing surfaces — a lesson that applies to any LST regardless of chain or staking architecture.

Techniques demonstrated (3)