ReadHistory

Qubit Finance

A BNB Chain lending protocol whose QBridge was exploited for about $80M on January 27, 2022. A logic flaw let an attacker mint unlimited 'qXETH' collateral without depositing any ETH, then borrow out the protocol's assets. Chainalysis later assessed it was likely North Korea-linked.

Also known as: Qubit Finance, QBridge, QBT

Summary

Qubit Finance was a South Korea-based DeFi lending protocol on BNB Chain that ran a cross-chain bridge, QBridge. On January 27, 2022, an attacker exploited a logic error in QBridge's deposit handling — a deprecated deposit function plus a custom transfer that did not revert on the zero address — to mint large amounts of "qXETH" (representing bridged ETH) without depositing any real ETH, then used it as collateral to borrow out roughly $80 million in assets. ^[1]^[2]

Attribution

The exploit drained essentially all of the protocol's holdings, making it one of the largest DeFi thefts of early 2022. Chainalysis later assessed that the attack was likely the work of North Korea-linked hackers, who bridged and mixed the proceeds in a now-familiar laundering pattern. ^[1]^[2]

Bracketed numbers refer to the numbered sources listed below.

Linked scams & cases

Orbit Chain bridge hackRelatedProjectsAbout $81.5M was drained from the Orbit Bridge (by South Korea's Ozys) on Dec 31, 2023 – Jan 1, 2024, via weak withdrawal/signature validation. Ozys later said a former security chief had weakened its firewall weeks earlier and pursued legal action.

People & entities involved

Radiant Capital hackRelatedProjectsA cross-chain lending protocol drained of about $50M on October 16, 2024. Mandiant attributed it to a North Korea-linked actor (UNC4736 / AppleJeus) that used a fake-contractor Telegram lure to plant macOS malware on developers' machines and forge multisig approvals.

Sources (2)

Qubit Bridge Collapse Exploited to the Tune of $80 Million — CertiK
How North Korea-linked cybercriminals hacked Qubit — Chainalysis