Key Highlights
- Hacker bypassed Sonic Labs’ freeze and moved 21 million staked $S tokens.
- The attacker used a gasless Permit2 off-chain approval to transfer funds despite two wallets being frozen on Nov 3.
- Community backlash grew over Sonic’s slow follow-up and perceived centralization after the freeze failed.
In the latest development on the Beets Fi exploit, hackers who previously attacked the protocol on November 3 have reportedly managed to bypass the wallets frozen by Sonic Labs and move the stolen funds.
The breach occurred on the Sonic blockchain, and the company is currently being criticized by the crypto community for the alleged flaw in its security.
Hacker moves 21 million tokens despite freeze
The exploiter was said to have used a gasless tool called Permit2 function to unlock one of the frozen wallets and move 21 million staked Sonic tokens. They then swapped the tokens for USDC on Kyber Network and quickly bridged the funds to Ethereum.
Sonic Labs had frozen two wallets a week earlier to stop the stolen assets from being moved following the initial Beets Fi hack. However, this new trick allowed the hacker to transfer funds even though the wallets were supposed to be locked.
Sonic’s early freeze fails to stop the attack
The firm first noticed the “suspicious activity” connected to Beets Fi around 3:45 a.m. EST on November 3. In a post on X, the team stated that the freeze was done to protect users and limit losses.
The affected wallet shared at the time had the tags “0xf19f…6bfae2 ” and “0x0453…be941c”. They were made public via SonicScan for transparency. Users with funds in those addresses were unable to make transactions during the freeze.
The exploit was linked to a Balancer vulnerability that impacted several chains, including Sonic’s Beets Fi system. Many in the community criticized the firm over its silence and the lack of an immediate patch.
Crypto influencer @YankeeRuinX confirmed the transfer in a post on X: “Welp guess that didn’t work as seems the hacker managed to transfer all the stolen funds an hour ago to a new address and has unloaded the 21M $stS plus other assets and bridged out to $ETH.”
Another user, @HalscionRose, commented, “Sonic having a bad day. The hacker used a gasless permit function to ‘unfreeze’ his wallet, move the $stS balance & subsequently dump it.”
The situation has made users call for answers, as the $S trading pair on Solana has now been given a freeze warning.
Also Read: Rumors of Bybit Buying Korbit Spark Buzz in Crypto Community
