On May 12, 2021, xToken was exploited when an attacker used an $81M flash loan (61,800 ETH) from dYdX to manipulate Kyber Network's oracle, enabling minting of xSNXa tokens at manipulated prices for ETH and SNX. The xBNTa contract had an additional flaw allowing minting with any token, not just BNT.

The DeFi pledge and liquidity strategy platform xToken was attacked, and the xBNTaBancor pool and the xSNXaBalancer pool were immediately exhausted, causing nearly $25 million in losses. The SlowMist security team analyzed that the two modules that were hacked this time were the xBNTa contract and the xSNXa contract in xToken. The two contracts were subjected to a "counterfeit currency" attack and an oracle manipulation attack.