PANews reported on November 11th that the GoPlus Chinese community posted on the X platform that Balancer hackers used the Permit authorization to pull off a successful escape. This morning, the Balancer attackers used the permit() authorization to transfer 195 stS tokens (worth approximately $3 million) frozen in the Sonic address 0xf19…fae2 to a new address: 0x0e9c…44D5, and then exchanged them for WBTC/ETH. The reason for the freeze's failure is that the freeze occurred at the native chain level, affecting only the S token and not other ERC20 tokens (such as stS in this case). stS has a permit() method, and the off-chain signature for permit() does not require the frozen address to pay S, thus rendering the freeze ineffective.PANews reported on November 11th that the GoPlus Chinese community posted on the X platform that Balancer hackers used the Permit authorization to pull off a successful escape. This morning, the Balancer attackers used the permit() authorization to transfer 195 stS tokens (worth approximately $3 million) frozen in the Sonic address 0xf19…fae2 to a new address: 0x0e9c…44D5, and then exchanged them for WBTC/ETH. The reason for the freeze's failure is that the freeze occurred at the native chain level, affecting only the S token and not other ERC20 tokens (such as stS in this case). stS has a permit() method, and the off-chain signature for permit() does not require the frozen address to pay S, thus rendering the freeze ineffective.

Balancer hackers used the Permit authorization to transfer 195 frozen STS tokens to a new address.

2025/11/11 12:40

PANews reported on November 11th that the GoPlus Chinese community posted on the X platform that Balancer hackers used the Permit authorization to pull off a successful escape. This morning, the Balancer attackers used the permit() authorization to transfer 195 stS tokens (worth approximately $3 million) frozen in the Sonic address 0xf19…fae2 to a new address: 0x0e9c…44D5, and then exchanged them for WBTC/ETH. The reason for the freeze's failure is that the freeze occurred at the native chain level, affecting only the S token and not other ERC20 tokens (such as stS in this case). stS has a permit() method, and the off-chain signature for permit() does not require the frozen address to pay S, thus rendering the freeze ineffective.

Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.