Lending protocol Ola Finance was hacked today on Fuse Network, one of many blockchains it works on, and the attacker has pocketed an estimated $3.6 million from various altcoin projects. PeckShield cybersecurity provider explained how attackers transferred liquidity.
Ola Finance hacked and altcoin projects stolen
PeckShield, a leading blockchain security and data analytics provider, announced today that Ola Finance’s lending mechanism has been hacked.
The first DeFi project on the EVM compatible Nlockchain Fuse Network (FUSE) Voltage Finance announced that it has withdrawn $4,000,000 from its Ola Finance system:
About 3 hours ago we became aware of a breach on the voltfinance credit platform that resulted in the theft of $4 million in USDC, FUSD, BUSD, WBTC, WETH & FUSE.
According to experts, the incident involved a common issue known as a re-login error. This issue is a smart contract vulnerability that allows hackers to make repeated calls to a protocol to steal assets. Just a few weeks ago, two DeFi protocols (Hundred Finance and Agave) on Gnosis Chain lost over $11 million in customer funds in rapid credit attacks resulting from re-entry failures.
Security firm PeckShield said the Ola Finance hacker first started by borrowing funds using their own collateral. After that, taking advantage of the re-entry vulnerability in Ola’s smart contracts, the hacker was able to remove the collateral without repaying the loan they received. The perpetrator then repeated the same process in other Ola Finance pools.
Attacks on crypto protocols increase in 2022
To carry out an attack, hackers transferred funds from Ethereum via the Tornado Cash hashing system. Recently, funds have been returned to Ethereum addresses that have already been flagged by mainstream explorers. Voltage Finance, USD Coin (USDC) operator Circle Inc. and CEX teams to blacklist relevant addresses on the Ethereum (ETH) Blockchain.
As we previously reported on Kriptokoin.com, DeFi hacks broke all previous records for the volume of stolen assets. Two days ago, Axie Infinity’s sidechain Ronin (RON) was drained for $625 million. The Ronin (RON) attack appears to be the largest in the history of decentralized finance (DeFi).
49169
