StrongBlock Loses $72K After Attacker Hijacks Abandoned Governance

An attacker drained approximately $72,000 in STRONG and STRNGR tokens after using StrongBlock’s abandoned governance system to seize administrative control of key protocol contracts.

Blockchain security firm Defimon Alerts said the attacker accumulated a majority of the voting power associated with STRONG, which lost most of its value as activity around the project declined. The attacker then submitted and approved a proposal that transferred control of StrongBlock’s Governor proxy.

Unlike a conventional smart contract exploit, the attacker did not need to bypass the protocol’s access controls. Instead, the attacker used StrongBlock’s governance rules exactly as they were designed, which turned the protocol’s voting system into the mechanism behind the theft.

The attack began when the attacker acquired enough STRONG tokens to control the outcome of a governance vote.

Defimon Alerts said the attacker submitted a proposal directing the Governor’s Upgrader contract to call setPendingAdmin(attacker). The proposal received enough votes, passed through the required queue and was executed on-chain.

Completing the governance process made the attacker’s address the administrator of the Governor proxy. The attacker could then replace the contract’s existing implementation with a new, unverified implementation under their control.

The replacement contract reportedly contained a forward(address, bytes) function that could only be called by the attacker’s externally owned account. This function allowed arbitrary transactions to be executed using the Governor contract’s authority.

Upgradeable proxy systems separate a contract’s stored data from its underlying logic. An authorized administrator can point the proxy toward a new implementation, effectively changing what the contract can do without changing its address. In this case, control of that upgrade permission allowed the attacker to transform the Governor into an arbitrary-call tool.

After installing the malicious implementation, the attacker used the Governor’s privileges to transfer assets from a StrongBlock-controlled pool.

The stolen assets included 32,695 STRONG and 383,447 STRNGR, which is more than 416,000 tokens in total. Defimon Alerts valued the assets at approximately $72,000 at the time of the incident.

StrongBlock originally promoted STRONG as the governance token for a protocol designed to reward blockchain node operators. STRNGR was later introduced as part of the project’s node-reward ecosystem.

Although the amount stolen was relatively small compared with major decentralized finance exploits, the incident proves how inactive protocols can continue to present security risks. Smart contracts, governance permissions and token balances are still operational on-chain even after developers and community members stop actively monitoring them.

Token-based governance generally assumes that voters with large holdings have a financial interest in protecting the protocol. That assumption can break down when a governance token becomes inexpensive while the contracts it controls still hold assets or powerful administrative permissions.

An attacker may then be able to purchase enough voting power to control the protocol for less than the value accessible through its contracts. Governance attacks can therefore occur without any software defect: the code performs the approved actions, but control of the approval process has become economically compromised.

Retiring a project requires more than shutting down its website, development activity or public communications. Teams must remove residual assets, revoke upgrade permissions, disable governance modules where possible and transfer any unavoidable administrative controls to securely managed addresses.

Other protections can include meaningful voting thresholds, execution delays, multisignature approval for critical upgrades, emergency cancellation mechanisms and active monitoring of pending proposals. A timelock is especially important because it creates a window in which suspicious governance actions can be identified before they are executed.

The StrongBlock takeover ultimately succeeded not because the attacker broke the protocol’s rules, but because those rules continued operating after the economic and community safeguards surrounding them had largely disappeared.