Decentralized finance (DeFi) platform Fei Protocol offered a $10 million bounty to hackers in an attempt to negotiate and retrieve a major chunk of the stolen funds from various Rari Fuse pools worth $79,348,385.61 — nearly $80 million.
On Saturday, Fei Protocol informed its investors about an exploit across numerous Rari Capital Fuse pools while requesting the hackers to return the stolen funds against a $10 million bounty and a “no questions asked” commitment.
We are aware of an exploit on various Rari Fuse pools. We have identified the root cause and paused all borrowing to mitigate further damage.
— Fei Protocol (@feiprotocol) April 30, 2022
To the exploiter, please accept a $10m bounty and no questions asked if you return the remaining user funds.
While the exact losses from the exploit were not officially released, DeFi investigator BlockSec’s monitoring system detected a loss of more than $80 million — citing the root cause as a typical reentrancy vulnerability. While reentrancy bugs have been the main culprit in many exploits within the DeFi ecosystem, the $80 million loot makes the Fei Protocol exploit one of the largest reentrancy hacks ever.
Upon further investigations, Rari developer Jack Longarzo revealed a total of six vulnerable pools (8, 18, 27, 127, 144, 146, 156) that have been temporarily paused while an internal fix is underway. At the time of writing, Rari’s internal and external security engineers partnered with DeFi service provider Compound Treasury to further investigate and neutralize the hack.
Providing further insights into the development, blockchain investigator PeckShield narrowed down the exploit to a reentrancy bug, which allows hackers to use a function and make external calls to another untrusted contract.
The old reentrancy bug bites again on Compound forks w/ $80M loss! This time, it re-enters via exitMarket()!!! https://t.co/NpC8AAZRXc
— PeckShield Inc. (@peckshield) April 30, 2022
Watch out, all Compound forks in EVM-compliant chains. Get in touch with your auditors now or feel free to contact us if we can be of any help pic.twitter.com/M9JElTWMSd
Security-focused ranking platform CertiK told Cointelegraph that the attacker has sent 5400 Ether (ETH), or $15,298,900 at the time of writing, to Tornado Cash and still holds 22,672.97 ETH, or $64,245,245.43 at the time of writing, in their wallet. The attack has drained funds from the Rari pool while the Fei Pools (Tribe, Curve) remain unaffected.
Last year on May 8, 2021, Rari Capital became victim to a high-priced exploit that was related to the integration with Alpha Venture DAO, previously Alpha Finance Lab. At the time of writing, there have been no official announcements from the Fei Protocol team on the results of their investigation.
Related: Plan for $1M bug bounties and double the nodes in wake of $600M Ronin hack
As the crypto community goes through an ever evolving battle against hackers, numerous projects and protocols have decided to amp up their security measures. On Th, the Ronin Network and Sky Mavis revealed plans to upgrade their smart contracts — following the $600 million hack in the previous month.
We have put together a postmortem regarding the Ronin exploit that occurred on March 23rd.
— Ronin (@Ronin_Network) April 27, 2022
• Why it happened
• What we're doing to make sure this never happens again
• Ronin bridge re-opening updatehttps://t.co/FfwCtCG84E
The United States Federal Bureau of Investigation (FBI) attributed the attack to North Korea-based and state-sponsored hacking group Lazurus, as it fired off a warning to other crypto and blockchain organizations.
As protocols such as Blast gradually open up pledge unlocking, most investors are about to usher in a good harvest, but for those who have lost their private keys for various reasons, this is a "countdown to death" again and again.
JinseFinanceOn the morning of February 15, 2024, we monitored that the DualPools project was attacked by hackers. The details are as follows.
JinseFinanceArtificial intelligence can easily steal 25 million US dollars. How should we prevent the crisis of artificial intelligence fraud? Golden Finance, artificial intelligence fraud has become a reality, causing concern.
JinseFinanceScams, hacks, and fraud remain a common problem with Crypto assets for many investors, businesses, and countries around the world.
JinseFinanceAurory Game Suffers $830K Token Theft, Disables Key Bridge
BerniceInitial findings from blockchain monitoring platform Peckshield point towards a reentrancy attack on Stars Arena's "Shares" contract.
DavinMango was attacked by hackers, and Mango lost a total of about 116 million U.S. dollars in this attack. In addition, Mango also suffered another attack from hackers, and Mango was attacked through a proposal.
JinseFinanceI don't want to eat melons anymore!
链向资讯Green, who plans to use the BAYC in an upcoming TV show, has hinted that he will go through the courts to get his BAYC back if the new owner doesn't give it up.
CointelegraphAgave and Hundred Finance have suspended operations while the investigation into the breach continues.
Cointelegraph