On June 8, 2022, ApolloX on BSC was exploited when a hacker accumulated 255 signatures using a flaw in the Trading Rewards Contract and used them to withdraw 53 million APX tokens from the Withdrawal Contract without proper verification. The tokens were swapped for ~$2.15M BUSD via PancakeSwap.

The ApolloX project was attacked due to a flaw in the ApolloX signature system. The attacker used the signature system flaw to generate 255 signatures, with a total of 53,946,802 $APX extracted from the contract, worth about $1.6 million.