In October 2022, an attacker exploited FTX's withdrawal fee sponsorship mechanism by submitting 500,000 gas unit withdrawal requests—far exceeding normal 21,000 gas transfers. FTX subsidized the excess fees, unknowingly covering costs for smart contract calls that minted XEN tokens on the attacker's behalf.

According to the X-explore blog, the hacker address starting with 0x1d37 is stealing GAS by exploiting the FTX vulnerability, minting XEN tokens 17,000 times at zero cost. The reason for this attack is that FTX does not limit the gas limit of the withdrawal transaction while the withdrawal fee is free. Instead, the estimateGas method is used to evaluate the handling fee. This method causes the GAS LIMIT to be mostly 500,000, which exceeds the default value of 21,000 by 24%. times.