Euler Finance was hit by a cryptocurrency flash loan attack on Sunday, with hackers stealing $197 million in multiple virtual assets.
The theft involved multiple tokens, including $8.75 million in DAI, $18.5 million in WBTC, $33.85 million in USDC, and $135.8 million in stETH.
The ETH used to store the stolen funds are being monitored, so it will be difficult for them to transfer the funds and convert them to another form.
However, Elliptic reports that hackers are already laundering profits through the approved cryptocurrency mixer, Tornado Cash.
See also: Windows CryptoAPI: Vulnerable to attacks due to a serious bug
The UK-based startup Euler Labs behind Euler Finance shared a statement on Twitter, saying it is in contact with security professionals and authorities and will release more information when they are ready.
After the attack, the value of the currency (EUL) fell by 44.2% overnight, reaching from $6.56 to $3.05 at the moment.
Flash loan attacks exploit weaknesses in lending protocols to borrow large amounts of money without having to repay the service.
Hackers use an exploit that allows them to manipulate the price of money or property on the platform during the few seconds they hold the loan amount, so that when the process is complete, they are left with a huge profit.
Proposal: Two Estonians stole 575 million worth of cryptocurrencies
The Beanstalk DeFi platform suffered a similar attack in April 2022, when hackers stole $182 million in assets.
Blockchain security and analytics firm PeckShield reports that the Euler hack was made possible due to some flaws in the logic of the donation and liquidation system.
More specifically, the “donateToReserves” function did not verify that the perpetrator donated an over-secured amount and the liquidation system did not correctly verify the conversion rate from the borrowed to the collateral asset.
These flaws allowed the perpetrators to manipulate the exchange rate to benefit from the liquidation process.
PeckShield says the attack involved 2 perpetrators, a borrower and a liquidator, who worked in sync to perform the following moves shown in the diagram.
DeFi hacks have been on the rise in recent years, with hackers abandoning their efforts to attack exchanges and focusing on quickly exploiting logic flaws in crypto lending platforms with smart contracts.
Read also: Final Cut Pro: Pirated version infects Mac with crypto miner
These attacks are so devastating that they can derail a healthy business that has already gone through multiple security checks overnight.
source of information: bleepingcomputer.com
