The Zunami Protocol, a decentralized finance (DeFi) platform, confirmed on Sunday that its liquidity pool on Curve Finance was under attack, resulting in a loss of over $2.1 million. The hack was reported by blockchain security firms PeckShield and Ironblocks.
Zunami Protocol is a stablecoin yield farming aggregator and maintains its primary “zStables” pool on Curve, which enables decentralized exchanges (DEX) of stablecoins within Ethereum.
Zunami, which operates as a Decentralized Autonomous Organization (DAO), promised “the highest APY on the market” and reported a total value of $5 million on its website. The cross-chain protocol aims to allow users to “diversify their stablecoin portfolio and avoid the risk of one of them crashing.”
The scheme used in the attack was well known to blockchain observers.
“The attacker took [a] Lightning credit from [the] Balancer, then he added liquidity, so he [would] “Being able to change the price significantly and started trading on the Zunami exchange,” Ironblocks explained. “Then he removed the liquidity and changed the price, then traded back and.” [returned] the quick loan and got 1,152 ETH for himself.
“Classic price manipulation,” concluded Ironblocks.
Blockchain analytics company PeckShield, which tracks attacks on Curve, also discovered the Zunami attack and reported the log on Twitter.
“Today’s hack resulted in a loss of more than $2.1 million and involved two hack transactions,” Peckshield said in a follow-up statement. “It is price manipulation that can be exploited through donations to miscalculate the price.”
“It appears that zStables was under attack. Collateral remains secure, we delve into the ongoing investigation,” Zunami posted on Twitter moments later. “Please do not buy zETH and UZD at the moment, their issue has been attacked.”
The price of both Zunami USD stablecoin (UZD) and Zunami ether (zETH) fell precipitously as a result of the hack, with the former plummeting completely — more than 99% — and the latter plunging over 88% to $206.
Zunami USD price chart (UZD) via CoinGecko.
The company reported that the funds have already been laundered via controversial coin mixer Tornado Cash.
Curve Finance has faced multiple attacks over the past few weeks and is still trying to recover about $19 million stolen by a hacker – and is posting a $1.8 million bounty on its head for information leading to the identify the perpetrator.
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.