How a Flash-Loan Price Squeeze Drained $24M From xToken's SNX and BNT Vaults

xToken.Market, a decentralized passive-investing protocol, lost more than $24 million on May 12, 2021 after an attacker used flash loans to manipulate the pricing of its yield-bearing liquidity pools for SNX (xSNXa) and BNT (xBNTa).

01Timeline of the response

At 15:14 UTC, xToken posted a warning stating that minting had been paused across all of its contracts while the team investigated reports of suspicious activity. Community members had already flagged an earlier tweet from the project within minutes of it going out. A subsequent statement confirmed that the xSNXa and xBNTa contracts had been exploited, that minting remained paused pending investigation, and that while the liquidity pools had been drained, most of the underlying SNX and BNT holdings were still sitting inside xToken's own contracts.

02How the attack worked

Per analysis attributed to 0xdeadfce and Frank Researcher, the attacker funded the operation with a 61,833 ETH flash loan from dYdX — worth roughly $267 million at the time — and executed it as a private transaction through Flashbots MEV. The full sequence, visible in the exploit transaction, broke down as follows:

1. Borrow 61.8k ETH via a dYdX flash loan.
2. Deposit 10k ETH on Aave to borrow 564k SNX, and separately swap 5.5k ETH for 700k SNX on SushiSwap.
3. Dump 1.2M SNX for 818 ETH on Uniswap v2, driving the on-chain SNX price sharply lower.
4. Exploit the depressed price to mint 1.2B xSNXa using only 0.12 ETH — possible because xToken's protocol sources SNX pricing through Kyber, which in turn was routing through the same distorted Uniswap v2 market.
5. Take advantage of the fact that xToken's internal accounting still valued xSNXa at a "normal" rate, allowing 105M xSNXa to be converted into 414 ETH.
6. Unwind the earlier SushiSwap and Uniswap trades and repay the Aave loan.
7. Offload the remaining xSNXa into the Balancer SNX/ETH/xSNXa (25/25/50) pool.
8. Repay the dYdX flash loan.
9. Repeat a similar trick against the BNT pool, minting xBNTa in four separate calls for a combined 0.03 ETH, netting 3.9B xBNTa.
10. Convert half of that xBNTa balance into 781k BNT.

03What was taken

xToken's tally of losses came to:

• 2.4k ETH (~$10.3M)
• 781k BNT (~$6.2M)
• 407k SNX (~$8M)
• 1.9B xBNTa

By the time the incident was reported, the attacker had already converted everything except the xBNTa holdings into roughly 5.6k ETH by routing through 1inch.

04Context

xToken had cultivated a reputation as a well-regarded, "blue chip" protocol with strong backers, which made the size of the loss notable — a reminder that reputation doesn't equal immunity, and that even protocols considered time-tested are still relatively young by any long-term measure. The incident gave xToken its first appearance on rekt.news's cumulative loss leaderboard, landing at the ninth spot. It also marked the fourth leaderboard appearance tied to security auditor PeckShield, making PeckShield the auditor most frequently associated with listed incidents at the time. Whether the exploit involved any inside knowledge of the protocol was never established.