On April 14, 2025, at 18:53 UTC, KiloEx was exploited for $7.5M via ETH/USD price oracle manipulation across Base, BSC, and opBNB. The attacker opened positions at artificially low prices and closed at real high prices without the oracle system validating feed freshness or enforcing rate limits.

The decentralized perpetual futures exchange KiloEx was attacked, involving assets across multiple chains including BNB and Base. According to an analysis by the SlowMist Security Team, the root cause of the incident was the lack of access control checks in KiloEx's top-level contract (MinimalForwarder), which allowed the manipulation of oracle prices. Thanks to the active response from the project team and collaboration with SlowMist and others, all stolen assets were successfully recovered after 3.5 days of effort.