Ankr & Helio Protocol Hack
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2DdfbQ…WEUpSummary
On December 1–2, 2022, a former Ankr employee carried out a supply chain attack that compromised the protocol's deployer private key, enabling the minting of trillions of aBNBc tokens and the draining of approximately $5 million in liquidity. Hours later, a separate attacker exploited Helio Protocol's slow price oracle to borrow $16.4 million in HAY stablecoin against nearly worthless aBNBc collateral, ultimately netting around $15.5 million. Combined losses exceeded $20 million, making it one of the most significant DeFi insider-threat incidents of 2022.
Connected Entities
5 entities · 60 linked investigations- Binance→mentioned with→Ethereum(65%)
- Chainlink→mentioned with→Ethereum(65%)
- Ankr & Helio Protocol Hack→mentioned with→Ethereum(80%)
- Ankr & Helio Protocol Hack→mentioned with→Chainlink(60%)
- Ankr & Helio Protocol Hack→mentioned with→Binance(70%)
- Ankr & Helio Protocol Hack→mentioned with→Changpeng Zhao(80%)
- Binance→mentioned with→Changpeng Zhao(80%)
- Changpeng Zhao→mentioned with→Binance(80%)
Timeline(11 events)
December 2022
Former Ankr employee's previously inserted malicious code extracts the deployer private key from Ankr's internal server. The attacker uses the key to deploy a modified aBNBc contract with an unauthorized minting function.
CoinDesk: Ankr ex-employee disclosure2 December 2022
At approximately 00:35 UTC, PeckShield detects anomalous aBNBc minting. Attacker mints approximately 6 quadrillion aBNBc tokens and dumps them on BNB Chain DEXes, netting roughly $5 million in USDC before bridging to Ethereum. aBNBc price falls 99.5% to under $2.
Ankr Blog: The aBNBc Token Report2 December 2022
A second attacker purchases 183,885 aBNBc tokens on 1inch for ~10 BNB (~$2,879), deposits them into Helio Protocol, and borrows 16,444,740 HAY (~$16.4M) via a stale price oracle. HAY is swapped for ~15.5M BUSD and transferred to Binance.
CoinDesk: How Attackers Made $15M From Helio After Ankr Exploit2 December 2022
Ankr confirms the exploit publicly and asks exchanges to halt trading of aBNBc. Binance CEO Changpeng Zhao announces Binance has frozen approximately $3 million of stolen funds.
The Record: Binance freezes $3M from Ankr hack2 December 2022
HAY stablecoin de-pegs to $0.20. Helio Protocol pauses all operations and initiates a HAY buyback program. Ankr announces $5M compensation plan for affected liquidity providers.
BeinCrypto: BNB-Based HAY Destablecoin Loses Peg Following Ankr Exploit5 December 2022
Ankr discloses formal reimbursement plan for affected users, specifying compensation only for liquidity providers 'caught off guard' — not for traders who purchased aBNBc after the exploit became public.
CoinTelegraph: Ankr says no one should trade aBNBc9 December 2022
Ankr airdrops ankrBNB tokens to prior aBNBc and aBNBb holders based on December 2 snapshot. aBNBc and aBNBb tokens are officially discontinued.
Ankr Blog: Recovery Program Targets and Milestones12 December 2022
Ankr completes BNB airdrops to affected DeFi liquidity pool participants. Ankr deploys $15M additional recovery fund directed at Helio's bad debt, purchasing excess HAY.
FinanceFeeds: Ankr airdrops new tokens, bought 6.8M HAY to ease bad debts20 December 2022
Ankr publicly discloses that a former team member conducted the attack via a supply chain exploit, inserting malicious code into an internal software update to steal the deployer key. Ankr states law enforcement has been alerted.
CoinDesk: DeFi Protocol Ankr Says Ex-Employee Caused $5M Exploit4 July 2023
Helio Protocol announces a strategic merger with Synclub, a BNB Chain liquid staking provider, beginning the transition toward a new brand identity.
Lista DAO Medium: Helio & Synclub Merger6 February 2024
Helio Protocol and Synclub officially relaunch as Lista DAO. HAY is renamed lisUSD, SnBNB is renamed lisBNB, and HELIO governance token is renamed LISTA.
Lista DAO X announcementDecision Log
- slot 423324475 · hash 5EiEH3B84RhvaXyyFygVA4khPXgdmsR3jk7yd3M7aNVR
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 12 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/31/2026, 6:58:45 AM
last updated: 5/31/2026, 6:58:45 AM
4 viewsavoid.net — verified advice for a post-truth world