According to Foresight News, the decentralized derivatives trading platform KiloEx has released its root cause analysis and post-incident review. The vulnerability's root cause was that the TrustedForwarder contract inherited OpenZeppelin's MinimalForwarderUpgradeable but failed to override the execution method, making it a function without permission requirements. After continuous negotiations, the hacker agreed to retain 10% of the bounty and systematically return all stolen assets to the Safe multisig wallet designated by KiloEx. The refund includes the original USDT, USDC, as well as exchanged assets such as ETH, BNB, WBTC, and Dai.
Foresight News previously reported that KiloEx's vault was hacked on April 15, resulting in a loss of approximately $7.4 million.
