According to ChainCatcher, KiloEx's analysis of the root cause of the hacking incident revealed that the issue originated from the TrustedForwarder contract in their smart contract, which inherited OpenZeppelin's MinimalForwarderUpgradeable but did not override the execute method, allowing the function to be called arbitrarily.
The attack occurred from 18:52 to 19:40 UTC on April 14, with the hacker deploying attack contracts across multiple chains including opBNB, Base, BSC, Taiko, B2, and Manta. After negotiations, the hacker agreed to keep 10% of the bounty and has returned all stolen assets (including USDT, USDC, ETH, BNB, WBTC, and Dai) to the multi-signature wallet specified by KiloEx.
