Sturdy Finance, a DeFi lending protocol, has lost almost $800,000 in ETH after a hacker exploited a vulnerability in its price oracle to gain access to its liquidity pool. The attack was confirmed by the protocol in a tweet on June 12, after receiving an alert from blockchain security firm PeckShield. The protocol has suspended all market transactions while further analyzing the situation.
Hacker moves stolen ETH to Tornado Cash
The hacker leveraged read-only reentry on the protocol’s price Balancer to manipulate the BstETH-STABLE price, resulting in the loss of 442 ETH valued at approximately $800,000. Sturdy Finance suspended its markets in response, and assured users of the safety of their remaining funds, stating that no action was required by users. However, the attacker has already transferred 442 ETH (nearly all of the stolen funds) to the currency mixer Tornado Cash, according to PeckShield.
DeFi hacks: a growing threat
Similar to other recent DeFi hacks, the hacker employed a price oracle exploitation to call a function multiple times before completing the initial call, enabling them to withdraw more funds. Meanwhile, Twitter account hijacking scams continue to target crypto users, with hackers stealing almost $1 million in crypto assets by using the accounts of influential figures to promote scam projects. The US Department of Justice has also recently charged two Russian nationals for the 2014 Mt. Gox hack in which 647,000 BTC was stolen.
Featured image from Pixabay and chart from TradingView.com
