PANews reported on October 15th that BlockSec Phalcon issued an alert stating that its system had detected several suspicious transactions (initiated by different EOAs) targeting two unknown contracts deployed to the same address on Ethereum, resulting in losses of approximately $120,000. The root cause is suspected to be a lack of access control on the critical functions approveERC20 and withdrawAll in the victim contract (which is not open source), allowing the attacker to drain the tokens held within the contract.

It is worth noting that the withdrawAll function requires the destruction of a sufficient amount of #sil tokens. This explains why in the second attack transaction (TX2, which caused the majority of the losses), the attacker first obtained #sil tokens through a flash loan, then performed multiple token swaps before carrying out the actual attack.