Nereus Finance's Shapeshifters NFT marketplace drained of 12.74 ETH via malicious proxy upgrade exploiting compromised admin key.
Security & Exploits ·
Nereus Finance's Shapeshifters NFT marketplace lost 12.74 ETH (approximately $23.76K) on August 4, 2026, following a compromise of its proxy admin key. The attacker leveraged an EIP-7702-delegated EOA holding ProxyAdmin ownership to execute a malicious upgrade via ProxyAdmin.upgradeAndCall, replacing the marketplace's implementation contract with a custom drainer. The newly deployed contract contained functions designed to sweep the proxy's entire ETH balance to a hardcoded attacker address, as well as a secondary ERC20-draining function protected by a tx.origin gate.
The exploit mechanics centered on the TransparentUpgradeableProxy architecture, in which administrative control over contract upgrades rests with a single key. Once that key was compromised, the attacker could redirect all logic to their own code without requiring additional authorization from users or other parties. The drainer contract's selector 0x8961ec50 executed the ETH sweep in a single transaction, moving funds to the attacker's address.
The incident underscores the concentration risk in upgradeable proxy patterns when admin keys lack multi-signature or time-lock safeguards. No mitigation steps, recovery mechanism, or disclosure of how the admin key was initially compromised have been detailed in available records.