Fx-pundiai swap bug and response ( NOT PUNDIX)

zaccheah · July 14, 2025, 9:57am

Summary

Two days ago, a bug was discovered.

Attackers have exploited our uninitialized ERC1967Proxy contracts (OZ common proxy standard), front-running deployers to set malicious implementations & spoofing. This bug unfortunately allowed the attacker to mint 1M $PUNDIAI tokens on 12 July UTC +8.

We have responded swiftly, including recovering > 70% (710,193 PUNDIAI) of the attacker minted PUNDIAI. Also, we managed to lock and recover ~$275k worth of attacker assets. Unfortunately, the attacker managed to get away with ~$260k worth of assets as it was already swapped from PUNDIAI into ETH/USDT/BNB.

Below is the post mortem report.

Background of exploit

This exploit surfaced recently and external reports believe it is widely affecting protocols that use the ERC1967Proxy contract (see screenshot below). Attackers deployed and set the malicious implementation contracts before the team did, and it was not detected, as fake upgrade events were emitted to deceive even Etherscan’s UI.

Attackers then attacked en masses starting from 10 July, we were unfortunately hit by the attack on 12 July alongside others.

First attack & our response.

The attack began on 12th July 2:12pm. Attacker minted 100M of $FX and swapped into 1M $PUNDIAI, ~11.75% of our circulating supply. We were alerted. It happened right after minting. The attacker first targeted liquidity on Pundi AIFX Omnilayer, bridging 400k PUNDIAI into Pundi AIFX Omnilayer at 2:15pm and started selling. We responded by freezing attacker funds 264,000 PUNDIAI and ~$96k of assets worth ~21.88 WETH, ~20,172 USDT and 21,938 PUNDIX. We close the bridge the same day at ~4pm.

Second attack & response.

Attacker moved 101,000 PUNDIAI from Ethereum to BSC using third party bridge Axelar at 3:14pm and started selling, the price dropped from $6.55 to $5.88 before quickly recovering at ~$6.30. The team and community removed liquidity starting from 4:55pm on BSC, squeezing out liquidity for attackers to sell. Since PUNDIAI token contract is deployed by Axelar, there is no freeze function, Axelar has assisted in limiting their bridge transfer to very small amounts of PUNDIAI.

In Pundi AIFX Omnilayer, the attacker sold and transferred to Ethereum about ~$88k USD worth of 81,022 PUNDIX, 13.828 ETH and 20,114 USDT. The attacker also moved from Pundi AIFX to BSC 40,263 USDT.

CEX response

CEX has frozen deposits of PUNDIAI on the same day of attack. We thank the respective CEX for reacting quickly.

Second day response

A day after the attack is Sunday Singapore time, we continue to monitor the situation and burn the attackers PUNDIAI on Ethereum. We did an emergency upgrade on Pundi AIFX Omnilayer to allow us to freeze only attackers funds and allow non attacker funds to be transferable, by now our Pundi AIFX Omnilayer is back to normal. Our thanks to partner validators for helping perform an emergency upgrade over the weekend.

As PUNDIAI transfer function is frozen on Ethereum, the attacker was unable to move ~180k of stolen USDT as it is in the form of USDT-PUNDIAI Uniswap LP. We could independently unfreeze a company address and swap out the 180k USDT stolen funds he made from providing liquidity into PUNDIAI-USDT and recover those funds.

Third day response (today)

~$265k worth of crypto and 710,193 PUNDIAI are locked or recovered by the team, while ~$260k worth of crypto is considered lost as it was swapped into ETH/USDT/BNB. There are still 78,191 PUNDIAI in BSC which we are unable to freeze as it is a third party implementation by Axelar which does not have the freeze function.

What happens next?

We will begin to unfreeze PUNDIAI on Ethereum in the coming days. Pundi AIFX Omnilayer is already unfrozen yesterday (13 July) and back to normal, and the attackers’ funds on Pundi AIFX are frozen forever. We will also communicate with CEX to resume deposits once we unfreeze PUNDIAI on Ethereum.

As for BSC, we are engaging Axelar and Pancake swap team, the current plan is to deploy a new PUNDIAI BSC token contract and replace it for PUNDIAI holders except for the attacker. This is because we cannot freeze the attacker’s funds. If we proceed with a new BSC token contract, it should happen in a week with snapshot being taken anytime now.

In conclusion we managed to recover >70% of stolen PUNDIAI we look forward to resuming PUNDIAI all chains over the next few days to a week.

—------------------------------------------end—-------------------------------------

transaction details

As of 15:53pm 13th July the impact is as below:

Funds recovered or locked (~275k worth of crypto and 710,193 PUNDIAI)

Ethereum 446,194 PUNDIAI (burnt)
fxcore 263,999 PUNDIAI (locked)
fxcore 21.88 WETH (locked)
fxcore 20,172 USDT (locked)
fxcore 31,938 PUNDIX (locked)
Ethereum 180,000 USDT (recovered)

Funds lost (~$260k worth of crypto and 78,191 PUNDIAI still held by attacker)

Ethereum 22.55 ETH
BSC 8.73 BNB
BSC 56,595 USDT
BSC 12,191 PUNDIAI
Ethereum 23,417 USDT
BSC 109,006 USDT
BSC 66,000 PUNDIAI (pancake LP)

Use DeBank to check how the attacker is moving the funds.

| — — — -Attacker mint — — — -|

https://etherscan.io/tx/0xec62e8b1c9f47c73825cab1c680c18cf27c41b66c77433aa5ae178455187336a

7-12–2025 14:12:23 UTC+8：Attacker uses swap contract to invoke pundiai token mint function and mints 1M $PUNDIAI https://etherscan.io/tx/0xd54ed7443aaf0d256aefe1797c32487e1ea5200c3d38b7a47ab02019caad0c56

Minted token sent to 0x26bC046BFA81ff9F38d0c701D456BfDf34b7F69c.

| — — — -Attacker bridges into Pundi AIFX Omnilayer— — — -|

7-12–2025 14:15:35 UTC+8: Attacker bridges 400k PUNDIAI into Pundi AIFX Omnilayer (aka FXCore) https://etherscan.io/advanced-filter?fadd=0x26bc046bfa81ff9f38d0c701d456bfdf34b7f69c&tadd=0x26bc046bfa81ff9f38d0c701d456bfdf34b7f69c&txntype=2&ps=100&mtd=0x6189d107%7eSend+To+Fx

Attacker starts swapping PundiAI token toUSDT/ETH/PUNDIX tokens https://etherscan.io/advanced-filter?fadd=0x26bc046bfa81ff9f38d0c701d456bfdf34b7f69c&tadd=0x26bc046bfa81ff9f38d0c701d456bfdf34b7f69c&ps=100&mtd=0x332caa1f%7eSubmit+Batch

bridge the swapped USDT/ETH/PUNDIX back to Ethereum because he knows we can halt our own chain.

| — — — -Attacks on BSC — — — -|
Attacker moves 101,000 PUNDIAI from Ethereum to BSC using Axelar.

0x26bc046bfa81ff9f38d0c701d456bfdf34b7f69c
0x7567a0417c62624d47fa4846e4f969737a4f7259

| — — Burning attacker PUNDIAI tokens on Ethereum — |

uniswap v4 pool manager (0x000000000004444c5dc75cB358380D2e3dE08A90): 10000
https://etherscan.io/tx/0xa004909b7be6c4fd38525636162e096cef344d6565bd3eed36d6aa63548a716a

uniswap v4 pool manager (0x000000000004444c5dc75cB358380D2e3dE08A90): 40000
https://etherscan.io/address/0x0f413055adef9b61e9507928c6856f438d690882

0x26bc046bfa81ff9f38d0c701d456bfdf34b7f69c
https://etherscan.io/tx/0x033173d2b3361625844b1201661ea68f3347672bd0188414df3eb31116951571
446194.735104745692945728 PUNDIAI burnt

dnes-saak45 · July 14, 2025, 10:23am

Hello, i did cross chain transfer usdt from pundiai to bsc couple of hours before, it stills shows pending but when i went inside and checked transaction it said success but i could see it was sent to burnt address… can you please refund it to my address… it still says pending… i have attached all the screenshots herewith. Thank you.

dnes-saak45 · July 14, 2025, 10:26am

Usdt from pundiai has already been out but have not received in bsc… can you please check and fix it. Thank you.

FrenchXCore · July 14, 2025, 11:02am

Just 2 questions :

Is the ERC1967Proxy contract patched as well, now ?
Any idea why PundiAI was targeted, knowing that there are thousands of other Cosmos-generated blockchains probably having much more liquidities ?

Thanks

Regards,
FrenchXCore

dnes-saak45 · July 14, 2025, 1:16pm

Also, can we please have clarity on snapshot… when is the snapshot taken… are we allowed to trade in binance alpha…what happens if we buy pundiai in binance aplha after snapshot taken… do we still have same amount of pundiai token that we hold in binance alpha even after we buy after snapshot taken… or we ll only get the token that is recorded at the time of snapshot… if so why still trading available in binance alpha…

Mauricio_Carbajal · July 14, 2025, 2:13pm

I understand that buying PUNDIAI on BSC is not safe right now, but what about exchanges like Gate or MEXC? I’m asking because I want to buy some tokens at this discount. Is there any issue, or should we still wait for the contract upgrade? Thx

IvanFunctionX · July 14, 2025, 10:46pm

You able to buy on mexc, you just can’t widraw to you wallet. You just need to wait to widraw

dnes-saak45 · July 15, 2025, 1:03am

Can you please cancel the transaction and refund back my money…it’s been already 17hrs and still pending.

Thank you.

IvanFunctionX · July 15, 2025, 6:06am

just wait sir

dnes-saak45 · July 16, 2025, 1:28am

Is there anyone from team here… can you please at least look on my case…

zaccheah · July 18, 2025, 1:28am

PundiAI have patched the loop hole ERC1967Proxy.
It’s not cosmos-related but a front running of ERC1967Proxy, and yes several others have also been affected, potentially more will surface.

zaccheah · July 18, 2025, 1:29am

You can buy and sell internally on CEX, we will start to unfreeze PUNDIAI on Ethereum in a few days and CEX will follow, this is when you can do CEX deposits and withdrawal.

zaccheah · July 18, 2025, 1:34am

You will have to wait for Pundi AIFX Omnichain (FXCore) transfer function to be reactivated, I know it’s not easy but please be patient for a few more days.

dnes-saak45 · July 18, 2025, 3:29am

what will happen to pundiai in bsc, do you upgrade to new contract and we get airdrop

indra · July 18, 2025, 7:26am

Hi everyone,

Following the recent ERC1967Proxy vulnerability that affected multiple projects industry-wide, we’d like to provide a quick and essential update in response to the recent community post.

All user funds remain safe and unaffected

PUNDIAI on Ethereum is now LIVE.

PUNDIAI on Pundi AIFX Omnilayer is also LIVE. The chain was unfrozen on July 13 and is now fully operational.

The Ethereum to/from Pundi AIFX Omnilayer bridge will be re-enabled shortly, so you can expect full functionality to return soon.

We would like to thank the community for your patience and support throughout this process. The attacker’s assets on the Pundi AIFX Omnilayer have been permanently frozen, and we are coordinating with centralized exchanges (CEXs) to re-enable PUNDIAI deposits on Ethereum in the coming days.

For BNB Chain:
PUNDIAI on BSC is still pending with Axelar for the new contract test, followed by airdrop and migration to the new token contract. The snapshot was taken a few days ago on BSC. Do NOT trade PUNDIAI BSC on PancakeSwap, the current liquidity on BSC is controlled by the hackers.

Thank you for your continued support.

The Pundi AI Team

Aritz_Bahamonde · July 18, 2025, 9:49am

Well.

i have a Cross-chain value transfer from Pundi AIFX to Polygon still pending. i hope this solves soon or after the update**

dnes-saak45 · July 21, 2025, 1:48am

how long it’s going to take, it’s already more than a week and my money is stuck… can you please fix this asap. Thanks…

zaccheah · July 22, 2025, 4:12am

Pundiscan cross chain bridge is enabled now, we will also be announcing on X soon.

Deo_Delic · July 22, 2025, 7:06am

or is it? I have deposited some pundi from eth and i cannot see it on core. Also bunch of pending transactions from like 10 days ago.

Sandeep · July 22, 2025, 7:10am

@Deo_Delic

If your Pundi was sent via Ethereum and it’s not showing on Core, it could be due to network compatibility or token support issues—especially if Core doesn’t natively recognize the ERC-20 version. Those older pending transactions might be clogging things up too. Did you check if the token needs to be manually added or if gas fees are affecting the confirmations?