Qubit Finance
A BNB Chain lending protocol whose QBridge was exploited for about $80M on January 27, 2022. A logic flaw let an attacker mint unlimited 'qXETH' collateral without depositing any ETH, then borrow out the protocol's assets. Chainalysis later assessed it was likely North Korea-linked.
Also known as: Qubit Finance, QBridge, QBT
Summary
Qubit Finance was a South Korea-based DeFi lending protocol on BNB Chain that ran a cross-chain bridge, QBridge. On January 27, 2022, an attacker exploited a logic error in QBridge's deposit handling — a deprecated deposit function plus a custom transfer that did not revert on the zero address — to mint large amounts of "qXETH" (representing bridged ETH) without depositing any real ETH, then used it as collateral to borrow out roughly $80 million in assets. [1][2]
Attribution
The exploit drained essentially all of the protocol's holdings, making it one of the largest DeFi thefts of early 2022. Chainalysis later assessed that the attack was likely the work of North Korea-linked hackers, who bridged and mixed the proceeds in a now-familiar laundering pattern. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
