RigoBlock's Dragos contracts lacked the onlyOwner modifier on the setMultipleAllowances function, allowing attackers to modify token allowances without authorization. An attacker exploited this to drain 160.86 ETH from the protocol's liquidity pools. The attacker later returned 90% of funds, retaining 10% as a bounty.

RigoBlock has been hacked. All tokens in Dragos except ETH and USDT are at risk due to protocol vulnerabilities being exploited. The hacker, Whitehat, has returned funds to the affected RigoBlock pool, leaving only 10% of the bug bounty reward.