On January 27-28, 2022 an attacker drained $80 million from Qubit Finance's QBridge cross-chain bridge by calling the deposit function with a zero address token and no ETH, exploiting improper use of call() instead of SafeERC20 verification to bypass input validation. The attacker minted 77,162 qXETH and borrowed $37.6M in wETH, $28.5M in BTC-B, and stablecoins.

Qubit, the lending product of QBridge, a BSC ecological decentralized lending project, is suspected to have been hacked. The hackers minted a large amount of xETH collateral and consumed about $80 million in assets in the capital pool. According to SlowMist's analysis, the main reason for this attack is that when the recharge of ordinary tokens and native tokens are implemented separately, when transferring the tokens in the whitelist, it is not checked again whether they are 0 addresses, resulting in The operation that should be recharged through the native recharge function can successfully go through the recharge logic of ordinary tokens.