Reentrancy Bug Drains $3M From Orion Protocol's Cross-Chain Broker Accounts

Orion Protocol, a self-described liquidity aggregator that pipes centralized-exchange liquidity on-chain, lost close to $3 million across Ethereum and BNB Smart Chain to a reentrancy exploit carried out on Thursday. The incident has no connection to Orion Finance, an unrelated project that had already lost $320,000 to an alleged rug pull on Arbitrum the previous day.

Word of the attack began circulating on Twitter within hours (first reports, then spreading further), prompting Orion CEO Alexey Koloskov to confirm the loss publicly. He stressed that the damage was confined to an internal broker account and that user deposits were untouched.

The irony wasn't lost on observers: Orion's own marketing describes the platform as solving "liquidity, custody, accessibility, and scalability" together for the first time — security, apparently, needed its own line item.

Mechanics of the exploit

Security firms SlowMist and PeckShield traced the incident to a reentrancy flaw triggered through a flash-loaned stablecoin swap that let the attacker credit the same deposit to their balance twice before withdrawing the inflated total.

The attacker deployed a custom token (referred to as ATK) and routed a swap of flash-loaned funds through it, so that a transfer hook inside ATK's contract could call back into Orion's depositAsset function mid-transaction — effectively doubling the attacker's recorded balance.

SlowMist's technical breakdown described the sequence as follows: the attacker first deposited 0.5 USDC through the depositAsset function of the ExchangeWithAtomic contract to set up the exploit. They then took out a flash loan of 284,700 USDT and called ExchangeWithAtomic's doSwapThroughOrionPool function to route a swap along the path USDC → ATK (the attacker's malicious token) → USDT. The contract calculates a swap's output as its post-trade USDT balance minus a starting balance of 2,844,700 USDT. Because the ATK transfer function fired mid-swap, it re-entered the depositAsset function, causing 284.4 million USDT from the flash loan to be credited into the ExchangeWithAtomic contract. That left the attacker's recorded deposit at 2,844,700 while the contract's actual USDT balance read 5,689,000, so the swap's output was computed as 5,689,000 minus 2,844,700. A subsequent call to the creditUserAssets library function then locked in the attacking contract's final ledger balance at roughly 5.68 million USDT. The attacker withdrew that USDT, repaid the flash loan, and converted the remaining 2.836 million USDT into WETH. The same technique, replayed on BNB Smart Chain, yielded a further $191,000. SlowMist attributed the root cause to Orion's exchange function lacking reentrancy protection.

PeckShield also published a diagram laying out the attack steps.

Addresses and fund flow

Two attacker addresses were active across both chains: 0x3dabf5e36df28f6064a7c5638d0c4e01539e35f1 (also on BSC) and 0x837962b686fd5a407fb4e5f92e8be86a230484bd (also on BSC).

Example transactions: on BSC and on Ethereum.

Most of the stolen funds were routed into Tornado Cash, though roughly $1 million in ETH still sat in the attacker's Ethereum address at the time of writing. That address had initially been funded from a wallet labeled as belonging to Binance, though the funds are said to have originated from a different exchange, SimpleSwap.

Orion's response

In a Twitter thread addressing the incident, Koloskov said he believed Orion's core protocol code was not to blame, suggesting instead that the vulnerability came from mixing third-party libraries into one of the smart contracts used by its experimental and private broker infrastructure.

Even so, a $3 million loss was enough to prompt a policy shift: Koloskov announced that all future contracts would be developed in-house, cutting reliance on outside libraries in an effort to strengthen the protocol going forward.