Carding
Professional
- Messages
- 2,870
- Reaction score
- 2,511
- Points
- 113
The attacker hacked the Conic Finance DeFi protocol, which is focused on the Curve platform. He withdrew about 1700 ETH (~$3.26 million).
According to analysts at Beosin, a hacker exploited the re-entry vulnerability by gaining access to the protocol's price oracle to manipulate the prices of steCRV, cbETH/ETH-f, rETH-f tokens and others.
This allowed the cracker to withdraw more liquidity tokens than he deposited. The perpetrator also borrowed 20,000 stETH to increase his income.
According to Conic, the exploit only affected the Omnipool pool on the Ethereum network. The protocol team is currently investigating the details of the incident.
According to PeckShield, the main attack contract was CurveLPOracleV2. Analysts emphasized that this component was not part of their audit.
