ChainBleedv0.1 · open intel
← back to feed·INFRASTRUCTURE2023-12-20 · 2y ago
Incident · SLOWMIST

INX

Third-party Vulnerability
Estimated loss
$1.60M
VERDICT —OUT OF SCOPE
Root cause is infrastructure (DNS / cloud / database / third-party API) compromise, not on-chain contract logic. Pre-deployment source review would not surface this; coverage lives in cloud-security + supply-chain audit, separate discipline.
▰ METHOD
INFRASTRUCTURE
INFRASTRUCTURE
Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

The INX Digital Company, a security token and digital asset trading platform, announced that on December 20, 2023, it learned of a cyberattack that occurred on the computer systems of a third-party vendor providing services to one of the Company's subsidiaries. As a result, a malicious actor managed to access the third-party vendor's servers and executed unauthorized trades which resulted in a loss of funds of the Company's subsidiary of approximately $1.6 million. The Company took immediate actions to remediate the security vulnerability and to investigate the nature and scope of the incident. The Company also notified relevant law enforcement in the appropriate jurisdictions and is working with the affected trading venue to investigate this incident and take appropriate legal action. INX customers were not affected by the incident, and the security breach at the third-party provider did not have any impact on the platforms and servers of INX. No personal information or other data of INX's customers was compromised, and INX.One remains fully operational. Attack method (per SlowMist): Third-party Vulnerability. Reported loss: $ 1,600,000.

Primary source
https://www.prnewswire.com/news-releases/inx-customer-data-and-funds-are-secure-after-recent-attack-on-third-party-service-provider-302023932.html
Sourced from
slowmist
Technical record
chain
protocol
INX
bug_class
infrastructure
date_occurred
2023-12-20
loss_usd
$1,600,000
source_id
sm:inx::2023-12-20
Related — same bug class· infrastructure
2026-04-18
1mo ago
Kelp DAO
Infrastructure-level attack
infrastructure
$293.00M
OUT OF SCOPE
2026-04-18
1mo ago
DNS registrar for eth.limo
DNS hijacking
infrastructure
OUT OF SCOPE
2026-04-04
2mo ago
HypurrFi
Domain Hijacking
infrastructure
OUT OF SCOPE
2026-03-31
2mo ago
Steakhouse Financial
Social Engineering
infrastructure
OUT OF SCOPE
2026-03-19
2mo ago
Neutrl
DNS Hijacking
infrastructure
OUT OF SCOPE
2026-03-18
2mo ago
ETH
Neutrl
DNS Hijacking Attack
infrastructure
OUT OF SCOPE
ChainBleed — live web3 threat intelligence