NovaBox Reward Pool Drained for 56.73 ETH in Ethereum Attack, F12 Says

NovaBox’s reward pool on Ethereum was hacked on June 9, resulting in a loss of about 56.73 ETH and affecting more than 130 deposit users. According to ChainCatcher, Bits.media reported that the attacker emptied the pool from 65.11 ETH to 0.09 ETH in a single transaction, draining about 99.86% of the funds. Security firm F12 said the incident was not caused by a smart contract vulnerability but by a flaw in the platform’s reward distribution mechanism. F12 said the attacker used an Aave V3 flash loan to borrow 427.5 WETH and exploited how NovaBox distributed dividends before updating user balances during deposits and withdrawals. F12 said the attacker first deposited a small amount of NOVA tokens to trigger dividend calculations, then deposited a large amount of ETH to sharply increase their effective share. Because the system did not update the balance in time, dividends were calculated based on the earlier small share but paid out based on the new larger share, creating about 145.82 ETH in what F12 described as “phantom dividends,” which depleted the reward pool.