{"investigation":{"slug":"kiloex","entity_name":"KiloEx","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"KiloEx is a decentralized perpetual futures exchange (DEX) backed by YZi Labs (formerly Binance Labs), deployed across opBNB, Base, BNB Chain, Taiko, and other networks. In April 2025, the platform suffered a $7.5–8.44 million oracle price manipulation exploit caused by an access control vulnerability in its TrustedForwarder contract; the attacker subsequently returned all stolen funds within 3.5 days after accepting a $750,000 white-hat bounty. The platform relaunched on April 24, 2025 after a partial security audit, with a full comprehensive audit still pending at that time.","sections":[{"content":"KiloEx is a decentralized perpetual contract trading platform that launched in 2023, originally as the first perpetual DEX deployed on opBNB. The protocol is backed by YZi Labs (previously Binance Labs), Foresight Ventures, Crescendo Ventures, and the Manta Foundation. KiloEx was selected from approximately 1,500 projects for the Binance Labs MVB VI incubator program. As of early 2025 the platform had accumulated over $35.88 billion in cumulative trading volume and approximately 40,350 users, with a total value locked (TVL) of around $46.76 million. The native governance and utility token, KILO, launched via a Token Generation Event (TGE) on March 27, 2025 through Binance Wallet and PancakeSwap, reaching an all-time high of approximately $0.17 on its launch date before declining sharply. KILO's market capitalization as of mid-2025 was approximately $1.3 million, down roughly 96% from its ATH.","heading":"Overview","sources":[{"url":"https://www.coinex.com/en/academy/detail/2363-what-is-kiloex-kilo-revolutionizing-perpetual-dex-trading-on-bnb-chain","name":"coinex.com","type":"other","credibility":3},{"url":"https://bsc.news/post/what-is-kiloex-kilo-token-analysis","name":"bsc.news","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/kiloex/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On April 14–15, 2025, KiloEx suffered a major security exploit resulting in losses of approximately $7.5 million to $8.44 million across six blockchain networks: Base, BNB Chain (BSC), opBNB, Taiko, B2 Network, and Manta. The root cause was an access control vulnerability in the TrustedForwarder contract. The contract inherited OpenZeppelin's MinimalForwarderUpgradeable but failed to override the execute method, leaving it publicly accessible without authorization. This allowed the attacker to forge a trusted caller identity and invoke the delegateExecutePositions function, which only checked whether the caller matched the trusted forwarder address without verifying actual authorization. The attacker exploited this to call setPrices() in the KiloPriceFeed contract, setting ETH/USD prices to artificially low values (e.g., $100) to open leveraged long positions cheaply, then inflating prices to $10,000 to close those positions at massive profit — all within single transactions. The attacker's wallet (0x00faC92881556A90FdB19eAe9F23640B95B4bcBd on Ethereum) was funded via Tornado Cash on April 13, 2025 at 23:31 UTC, with attack contracts deployed across six chains on April 14, and exploits executed between 18:52–19:40 UTC on April 14. The blockchain security firm Cyvers first publicly reported the attack. KiloEx immediately suspended platform operations and engaged SlowMist, Seal-911, and Sherlock to investigate and trace stolen funds.","heading":"April 2025 Oracle Manipulation Exploit","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-kiloex-hack-april-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-assists-kiloex-in-recovering-all-stolen-funds-incident-recap-273d10f6d466","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2025/04/15/dex-kiloex-loses-usd7m-in-apparent-oracle-manipulation-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://crypto.news/kiloex-perpetual-dex-loses-7-4m-in-price-oracle-exploit/","name":"crypto.news","type":"other","credibility":3},{"url":"https://nulltx.com/7-million-exploit-hits-kiloex-flawed-access-control-allows-price-manipulation-across-multiple-chains/","name":"nulltx.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, KiloEx publicly offered the attacker a $750,000 white-hat bounty — representing 10% of the approximately $7.5 million stolen — in exchange for the return of 90% of stolen assets, with a promise of no legal action. KiloEx also worked with Binance, which reportedly assisted in freezing or tracing approximately $6.1 million of the stolen funds. Within approximately 3.5 days of the exploit, the attacker returned all stolen assets — including USDT, USDC, ETH, BNB, WBTC, and DAI — to KiloEx's official multisig wallets. The full recovery was confirmed on approximately April 18, 2025. SlowMist's MistTrack platform and threat intelligence network were credited with assisting in tracing the attacker's movements during negotiations. The identity of the attacker was not publicly disclosed. KiloEx stated it would not pursue legal action against the hacker pursuant to the bounty agreement.","heading":"Fund Recovery and White-Hat Bounty","sources":[{"url":"https://cointelegraph.com/news/kiloex-exploiter-returns-5-5-m-7-5-m-dex-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-assists-kiloex-in-recovering-all-stolen-funds-incident-recap-273d10f6d466","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2025/04/18/kiloexs-sophisticated-hack-shows-defi-risks-but-this-time-recovery-was-swift","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.coinspeaker.com/kiloex-hack-binance-helped-recover-6-1-million-in-lost-funds/","name":"coinspeaker.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/04/18/kiloex-hacker-returns-stolen-funds-just-days-after-hack/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following fund recovery, KiloEx published a post-mortem report on April 21, 2025 detailing the root cause and attack timeline. The platform engaged SlowMist for a security audit. Two audit plans were considered: a 45-day comprehensive audit before relaunch, or a faster permissions-focused audit followed by a later comprehensive audit. KiloEx opted for the second, faster plan, citing community feedback and timeline considerations. KiloEx resumed trading and deposit functions across all supported chains beginning at 12:00 UTC on April 24, 2025, with the comprehensive full audit still pending at that time. Critics noted the decision to relaunch before completing the full audit introduced ongoing security risk. KiloEx also announced a compensation plan for affected users: traders with open positions during the outage window (18:27–19:40 UTC on April 14) were to receive reimbursement for incremental losses; Hybrid Vault stakers were offered their principal plus a special 10% APY boost campaign; VIP users received a 30-day status protection period and a tier upgrade.","heading":"Security Audit and Relaunch","sources":[{"url":"https://crypto.news/kiloex-reveals-7m-smart-contract-exploit-in-post-mortem-report/","name":"crypto.news","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/tech/kiloex-to-go-through-complete-audit-before-relaunch/","name":"bitcoinethereumnews.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2025/04/24/kiloex-to-compensate-users-impacted-by-usd7m-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://beincrypto.com/kilo-drops-5-despite-kiloex-comeback-and-compensation-plans/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/crypto/kiloex-resumes-crucial-operations-after-7m-crypto-hack/","name":"bitcoinethereumnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The KILO token launched on March 27, 2025 — approximately two weeks before the exploit — with a total supply of 1 billion tokens and an initial circulating supply of approximately 21.17%. The token reached an all-time high of approximately $0.17 on launch day via Binance Wallet and PancakeSwap. Following the April 14–15 exploit, KILO's price dropped significantly. Despite a brief recovery surge when fund return was announced on approximately April 18, the token continued to decline over subsequent months. As of mid-2025, KILO was trading at approximately $0.006, representing a decline of roughly 96.4% from its ATH. The token's market capitalization had fallen to approximately $1.3 million. An additional 8.6 million unclaimed airdrop tokens were burned in September 2025. The KILO token was listed on multiple centralized exchanges including Bybit, Gate, MEXC, and Bitget.","heading":"KILO Token Performance and Market Impact","sources":[{"url":"https://coinmarketcap.com/currencies/kiloex/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/kiloex","name":"coingecko.com","type":"other","credibility":3},{"url":"https://icodrops.com/kiloex/","name":"icodrops.com","type":"other","credibility":3},{"url":"https://cryptorank.io/ico/kiloex","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The KiloEx exploit was part of a broader wave of DeFi security incidents in April 2025, which became one of the costliest months for crypto losses since the Bybit hack. The oracle manipulation technique used against KiloEx echoes similar attacks on Mango Markets ($100 million in 2022) and Cream Finance ($130 million in 2021). The attacker's use of Tornado Cash to fund the exploit wallet is a pattern consistent with sophisticated actors seeking to obscure their identity before executing on-chain attacks. The swift recovery — full return within 3.5 days — was considered unusual in the DeFi exploit landscape, where funds are rarely returned. Security researchers noted the vulnerability stemmed from a failure to override an inherited method in an OpenZeppelin contract, a relatively common but preventable class of smart contract bug. ZachXBT, the blockchain investigator, is reported to have flagged or monitored the KiloEx incident as part of broader tracking of April 2025 DeFi security events.","heading":"DeFi Risk and Broader Context","sources":[{"url":"https://www.coindesk.com/tech/2025/04/18/kiloexs-sophisticated-hack-shows-defi-risks-but-this-time-recovery-was-swift","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=kiloex-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-kiloex-hack-april-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://cryptogiggle.com/crypto-news-latest-cryptocurrency-news/the-costliest-month-for-crypto-losses-since-the-bybit-hack-is-april/","name":"cryptogiggle.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-04","event":"KiloEx launches as the first perpetual DEX on opBNB, backed by Binance Labs (later YZi Labs)","source":"","date_original":"2023-04-01"},{"date":"2023-08","event":"YZi Labs (then Binance Labs) makes strategic investment in KiloEx; Foresight Ventures invests in March 2024","source":"","date_original":"2023-08-01"},{"date":"2025-03-27","event":"KILO token launches via TGE on Binance Wallet and PancakeSwap; hits ATH of approximately $0.17","source":""},{"date":"2025-04-13","event":"Attacker withdraws 1 ETH from Tornado Cash at 23:31 UTC to fund exploit preparation","source":""},{"date":"2025-04-14","event":"Attack contracts deployed on opBNB, Base, BSC, Taiko, B2, and Manta between 18:27–19:40 UTC; exploit executed across all chains draining approximately $7.5–8.44 million","source":""},{"date":"2025-04-15","event":"KiloEx suspends all platform operations; Cyvers publicly flags the exploit; KiloEx engages SlowMist, Seal-911, and Sherlock for investigation","source":""},{"date":"2025-04-15","event":"KiloEx offers $750,000 white-hat bounty (10% of stolen funds) in exchange for return of 90% and promise of no legal action","source":""},{"date":"2025-04-18","event":"Attacker returns all stolen funds to KiloEx multisig wallets within 3.5 days of the exploit","source":""},{"date":"2025-04-21","event":"KiloEx publishes post-mortem security report detailing TrustedForwarder access control vulnerability as root cause","source":""},{"date":"2025-04-24","event":"KiloEx resumes trading and deposits across all chains at 12:00 UTC after permissions-focused security audit; announces user compensation plan","source":""},{"date":"2025-09","event":"KiloEx burns 8.6 million unclaimed airdrop KILO tokens","source":"","date_original":"2025-09-01"}],"sources_used":[{"url":"https://www.coinex.com/en/academy/detail/2363-what-is-kiloex-kilo-revolutionizing-perpetual-dex-trading-on-bnb-chain","name":"coinex.com","type":"other","archive_url":"http://web.archive.org/web/20251217041037/https://www.coinex.com/en/academy/detail/2363-what-is-kiloex-kilo-revolutionizing-perpetual-dex-trading-on-bnb-chain","credibility":3,"archive_timestamp":"2025-12-17T04:10:37+00:00"},{"url":"https://bsc.news/post/what-is-kiloex-kilo-token-analysis","name":"bsc.news","type":"other","archive_url":"http://web.archive.org/web/20260515191844/https://bsc.news/post/what-is-kiloex-kilo-token-analysis","credibility":3,"archive_timestamp":"2026-05-15T19:18:44+00:00"},{"url":"https://coinmarketcap.com/currencies/kiloex/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260523041048/https://coinmarketcap.com/currencies/kiloex/","credibility":3,"archive_timestamp":"2026-05-23T04:10:48+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-kiloex-hack-april-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260415064919/https://www.halborn.com/blog/post/explained-the-kiloex-hack-april-2025","credibility":3,"archive_timestamp":"2026-04-15T06:49:19+00:00"},{"url":"https://slowmist.medium.com/slowmist-assists-kiloex-in-recovering-all-stolen-funds-incident-recap-273d10f6d466","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250906075608/https://slowmist.medium.com/slowmist-assists-kiloex-in-recovering-all-stolen-funds-incident-recap-273d10f6d466","credibility":3,"archive_timestamp":"2025-09-06T07:56:08+00:00"},{"url":"https://www.coindesk.com/markets/2025/04/15/dex-kiloex-loses-usd7m-in-apparent-oracle-manipulation-attack","name":"coindesk.com","type":"other","archive_url":"https://web.archive.org/web/20260915165648/https://www.coindesk.com/markets/2025/04/15/dex-kiloex-loses-usd7m-in-apparent-oracle-manipulation-attack","credibility":3,"archive_timestamp":"2026-09-15T16:56:48+00:00"},{"url":"https://crypto.news/kiloex-perpetual-dex-loses-7-4m-in-price-oracle-exploit/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20260314032202/https://crypto.news/kiloex-perpetual-dex-loses-7-4m-in-price-oracle-exploit/","credibility":3,"archive_timestamp":"2026-03-14T03:22:02+00:00"},{"url":"https://nulltx.com/7-million-exploit-hits-kiloex-flawed-access-control-allows-price-manipulation-across-multiple-chains/","name":"nulltx.com","type":"other","archive_url":"http://web.archive.org/web/20260421011720/https://nulltx.com/7-million-exploit-hits-kiloex-flawed-access-control-allows-price-manipulation-across-multiple-chains/","credibility":3,"archive_timestamp":"2026-04-21T01:17:20+00:00"},{"url":"https://cointelegraph.com/news/kiloex-exploiter-returns-5-5-m-7-5-m-dex-exploit","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260726142458/https://cointelegraph.com/news/kiloex-exploiter-returns-5-5-m-7-5-m-dex-exploit","credibility":3,"archive_timestamp":"2026-07-26T14:24:58+00:00"},{"url":"https://www.coindesk.com/tech/2025/04/18/kiloexs-sophisticated-hack-shows-defi-risks-but-this-time-recovery-was-swift","name":"coindesk.com","type":"other","archive_url":"https://web.archive.org/web/20260915170710/https://www.coindesk.com/tech/2025/04/18/kiloexs-sophisticated-hack-shows-defi-risks-but-this-time-recovery-was-swift","credibility":3,"archive_timestamp":"2026-09-15T17:07:10+00:00"},{"url":"https://www.coinspeaker.com/kiloex-hack-binance-helped-recover-6-1-million-in-lost-funds/","name":"coinspeaker.com","type":"other","archive_url":"http://web.archive.org/web/20260308023059/https://www.coinspeaker.com/kiloex-hack-binance-helped-recover-6-1-million-in-lost-funds/","credibility":3,"archive_timestamp":"2026-03-08T02:30:59+00:00"},{"url":"https://www.cryptotimes.io/2025/04/18/kiloex-hacker-returns-stolen-funds-just-days-after-hack/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829085427/https://www.cryptotimes.io/2025/04/18/kiloex-hacker-returns-stolen-funds-just-days-after-hack/","credibility":3,"archive_timestamp":"2026-08-29T08:54:27+00:00"},{"url":"https://crypto.news/kiloex-reveals-7m-smart-contract-exploit-in-post-mortem-report/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251018142743/https://crypto.news/kiloex-reveals-7m-smart-contract-exploit-in-post-mortem-report/","credibility":3,"archive_timestamp":"2025-10-18T14:27:43+00:00"},{"url":"https://bitcoinethereumnews.com/tech/kiloex-to-go-through-complete-audit-before-relaunch/","name":"bitcoinethereumnews.com","type":"other","archive_url":"http://web.archive.org/web/20260829023910/https://bitcoinethereumnews.com/tech/kiloex-to-go-through-complete-audit-before-relaunch/","credibility":3,"archive_timestamp":"2026-08-29T02:39:10+00:00"},{"url":"https://www.coindesk.com/business/2025/04/24/kiloex-to-compensate-users-impacted-by-usd7m-attack","name":"coindesk.com","type":"other","archive_url":"https://web.archive.org/web/20260915164756/https://www.coindesk.com/business/2025/04/24/kiloex-to-compensate-users-impacted-by-usd7m-attack","credibility":3,"archive_timestamp":"2026-09-15T16:47:56+00:00"},{"url":"https://beincrypto.com/kilo-drops-5-despite-kiloex-comeback-and-compensation-plans/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251005232103/https://beincrypto.com/kilo-drops-5-despite-kiloex-comeback-and-compensation-plans/","credibility":3,"archive_timestamp":"2025-10-05T23:21:03+00:00"},{"url":"https://bitcoinethereumnews.com/crypto/kiloex-resumes-crucial-operations-after-7m-crypto-hack/","name":"bitcoinethereumnews.com","type":"other","archive_url":"https://web.archive.org/web/20260829073133/https://bitcoinethereumnews.com/crypto/kiloex-resumes-crucial-operations-after-7m-crypto-hack/","credibility":3,"archive_timestamp":"2026-08-29T07:31:33+00:00"},{"url":"https://www.coingecko.com/en/coins/kiloex","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://icodrops.com/kiloex/","name":"icodrops.com","type":"other","archive_url":"http://web.archive.org/web/20260518060712/https://icodrops.com/kiloex/","credibility":3,"archive_timestamp":"2026-05-18T06:07:12+00:00"},{"url":"https://cryptorank.io/ico/kiloex","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829030636/https://cryptorank.io/ico/kiloex","credibility":3,"archive_timestamp":"2026-08-29T03:06:36+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=kiloex-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260212065317/https://www.web3isgoinggreat.com/?id=kiloex-exploit","credibility":3,"archive_timestamp":"2026-02-12T06:53:17+00:00"},{"url":"https://cryptogiggle.com/crypto-news-latest-cryptocurrency-news/the-costliest-month-for-crypto-losses-since-the-bybit-hack-is-april/","name":"cryptogiggle.com","type":"other","archive_url":"http://web.archive.org/web/20260113145159/https://cryptogiggle.com/crypto-news-latest-cryptocurrency-news/the-costliest-month-for-crypto-losses-since-the-bybit-hack-is-april/","credibility":3,"archive_timestamp":"2026-01-13T14:51:59+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:24.435154+00:00","updated_at":"2026-09-15T17:10:50.842714+00:00"}}