Crypto staking platform Bedrock exploited via a bug, users can swap 1 ETH for 1 BTC

Staking protocol Bedrock has confirmed that a bug involving uniBTC has leaked into their platform, allowing users to exchange uniBTC for ETH token.

Bedrock announced via an X post on September 27 that they were aware of the security breach and that the issue was now “taken care of” by their team.

They also assured users that the remaining funds are safe and plan to initiate a refund plan in the near future, estimating the total loss to be around $2 million in digital assets.

However, a user on the platform discovered that the bug allowed them to exchange their Bitcoin (BTC) for Ethereum (ETH). This is because the vulnerability directly affects the platform’s uniBTC, a synthetic Bitcoin token used in DeFi.

“This functionality was probably left over from the uniETH app,” the user said.

According to data from Crypto.news, Bitcoin was sold for $65,449 per token, while the price of Ethereum was $2,659 at the time of writing.

Bedrock claimed that most of the losses were due to decentralized exchange liquidity pools and explained that the underlying wrapped Bitcoin tokens and standard Bitcoin held in reserves were safe.

“There is no need for our community to take any additional action at this time. “You can be sure that all uniBTCs held by users are safe,” Bedrock said, adding that the platform will publish an autopsy report shortly.

As of now, the protocol team has identified the root cause of the vulnerability and is working closely with audit teams to recover the lost funds.

⚠️Important Announcement from Bedrock Team

We would like to inform you that the Bedrock team is aware of a security vulnerability involving uniBTC. The issue was resolved and the funds were transferred to SAFU.

We want everyone to secure base wrapped BTCs and BTCs in reserves…

— Bedrock | Bitcoin Restock LIVE (@Bedrock_DeFi) September 27, 2024

Bedrock was launched in February 2023 by Singapore-based blockchain firm RockX. The protocol is designed to make liquid staking attractive to institutional investors by prioritizing compliance with know-your-customer and anti-money laundering regulations.

Bedrock is ranked as the eighth-largest liquid staking protocol with over $240 million in total value locked on its platform, according to DefiLlama.