The $7.5 million exploit on KiloEx was executed by an attacker who manipulated KiloEx’s price oracle system using a permissionless function to open and close trades at artificial prices for profit.

Quotes that support claims

The attacker appeared to exploit a vulnerability in the platform's price oracle system.

In a post-mortem published by KiloEx, the platform confirmed that the attacker exploited a permissionless function. The DEX said the attacker crafted a request that only authorized entities should have been able to do.