The Kyber Network has confirmed the attack, citing KyberSwap Elastic, and advising all users to promptly withdraw their funds.

KyberSwap Elastic is an upgrade to the existing protocol known as KyberDMM (now KyberSwap Classic). The new protocol inherited all the KyberSwap Classic strengths while introducing concentrated liquidity.

Reportedly, the attack has targeted all 15 chains of the network's flagship product, KyberSwap, which is the crosschain DEX and aggregator that enables users to trade smart and maximize earnings.

According to industry sleuths, the Kyber exploits are flash loans with some kind of rounding issue, as every transaction starts with an ETH balance coming in, looped mint/redeem/swap.

Kyber network exploit

On-chain detectives say it is an approval issue with Kyber aggregator, with the hacker probably just draining the Kyber LP pools.

This could mean that if someone were trading (swapping) there would not be any risk, with the bad actor only going for staked amounts in the liquidity pools. Traders are not affected by this exploit.

Kyber liquidity providers (LPs) are urged to withdraw their stakes immediately.

FXSteet team has contacted the Kyber Network for comments.

Hacker returns with a message

In an interesting turn, the hacker has returned with a message, saying, "Negotiations will start in a few hours when I am fully rested."

Source