Avalanche-Based Stars Arena Falls Victim To a $3M Hack

Updated: 09 October 2023

Disclosure

Don’t invest unless prepared to lose all the money you invest. This is a high-risk investment, you shouldn’t expect to be protected if something goes wrong.

Join Our Telegram channel to stay up to date on breaking news coverage

Web3 social media app Stars Arena has lost around $3 million worth of AVAX tokens from its smart contract following an exploit.

The Avalanche-based protocol confirmed the exploit on X, urging users not to deposit funds. The hack drained nearly all funds from the protocol, with the total value locked currently at $0.051, according to DeFiLlama.

There has been a major security breach with the smart contract.

We're actively checking the issue.

DO NOT deposit any funds.

Stay tuned for updates.

— The Arena (@TheArenaApp) October 7, 2023

Security analysts at PeckShield attributed the vulnerability to a re-entrance issue. The bug allowed the hackers to sell tickets at a much higher price than they were worth.

#PeckShieldAlert @starsarenacom has been hacked for ~$2.9M pic.twitter.com/VSw8k3AVEq

— PeckShieldAlert (@PeckShieldAlert) October 7, 2023

The exploiters stole 266,103 AVAX tokens from Stars Arena before transferring the funds to the Fixed Float crypto exchange. Stars Arena said that besides the exploit, its website was also under a distributed denial of service (DDoS) attack.

“Our smart contract was exploited, and the funds were drained. The site is currently under a DDoS attack. We are working on a solution to get everyone’s funds recovered and have the Arena move forward,” the team said.

Stars Arena later said it had secured resources to close the gap caused by the hack. It also noted that the smart contract will re-open after conducting a full security audit.

Important news: we have secured the resources to close the gap caused by the exploit.

Additionally, a special white hat development team is coming in to rapidly review the security of the platform.

We will re-open the contract with all the funds in full after a full security…

— The Arena (@TheArenaApp) October 7, 2023

The project has also collaborated with Paladin Blockchain Security to improve its security infrastructure. However, it is not clear when the project will re-open.

Stars Arena Hit By Second Exploit In A Week

The recent $3M hack was the second attack in just one week. On October 5, the team said it patched a vulnerability that caused around $2,000 in losses. At the time, it claimed that the attack was part of a “coordinated FUD.”

Avalanche’s co-founder, Emin Gün Sirer, also appeared to downplay the first attack, saying there was much FUD around the exploit. Sirer seemed to hype the project, urging users to “get back to having fun in the arena” as the exploit was fixed.

So much FUD about a Stars Arena exploit that has (1) already been fixed, (2) cost the attacker $0.25 to make $0.04, and (3) the attacker extracted a sum total of only $2,000. Now that it's over, let's get back to having fun in the arena.

— Emin Gün Sirer🔺 (@el33th4xor) October 5, 2023

This year alone, around $1.3 billion in crypto assets have been drained in hacking exploits.

Newest Meme Coin ICO - Wall Street Pepe

Rating