On June 9, 2024, Loopring's Official Guardian 2FA service (off-chain infra) was compromised, allowing attackers to masquerade as wallet owners, reset ownership, and steal $5M from Smart Wallets. Users with single guardian reliance were especially vulnerable.

Ethereum Layer 2 protocol Loopring posted on Twitter that the some Loopring Smart Wallets were targeted in a security breach. The attack exploited wallets with only one Guardian, specifically the Loopring Official Guardian. The hacker initiated a Recovery process, falsely posing as the wallet owner to reset ownership and withdraw assets. The attack succeeded by compromising Loopring's 2FA service, allowing the hacker to impersonate the wallet owner and gain approval for the Recovery from the Official Guardian. Subsequently, the attacker transferred assets out of the affected wallets.