Leaderboard
859All-time rank
Voltage V3
Mar 18, 2025
$322K
Lost
$322K
Recovered
$0
Net loss
$322K
Unrecovered0% recovered
An attacker compromised the SimpleChefStaking proxy contract, replacing its implementation with a malicious one. The attacker then used the forceWithdraw function to drain collateral from the Simple Staking pools, extracting USDCE and WETH.
Voltage offered a $50k bounty for recovery of the remaining funds.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Fuse
Event timeline
- Mar 18, 2025Exploit executed — $322K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%