Deus Finance Gets Hacked As Over $13 Million Stolen In Latest Flash Loan Based Exploit

Deus Finance DAO has become the latest target of a hack that saw a massive $13.4 million be stolen. To make matters worse, this is the second attack on the platform within the past 2 months.

What happened?

PeckShield, a blockchain security company, announced on April 28th that hackers had indeed compromised Deus Finance, a decentralized finance initiative that uses the Fantom blockchain. According to the firm, the incident resulted in a loss of over $13 million, with ETH accounting for the majority of the stolen assets.

The breach was reportedly made feasible by the modification of the price oracle which reads from the StableVW AMM, USDC/DEI pair via a flash loan. The modified collateral DEI price was then utilized to borrow from and drain the pool.

Another day, another flash loan exploit

Unfortunately, this is not the first time that hackers have successfully stolen funds through flash loan based exploits, and judging from the most recent activities, it will most likely not be the last either. After being utilized in some of the most high-profile assaults of 2022 alone, flash loans have gained quite the reputation of being among the most popular ways to target DeFi platforms.

The breach was triggered by a total of 800 ETH, which was extracted from Tornado Cash and transmitted to Fantom via the MultiChain. The stolen funds were subsequently converted to Ether and transferred to the hackers account at the end of the assault.

There may be some light at the end of the tunnel though, as the hackers wallet address was quickly marked with a warning that marks it as being allegedly involved in a flash loan exploit. However, the damage has already been done and it is currently unclear whether the hacker has already sent the stolen crypto to another wallet by now.

From bad to worse

The previous attack, which took place in March, was eerily similar to the most recent attack in that it employed the same flash loan-assisted pricing manipulation. The funds were moved from Tornado Cash and transferred in the same manner as the April hack.

Needless to say, the community is extremely disappointed that the protocol has been hacked again in the same way and in such a short period of time. While we await an official response, countless calls have since been made to Circle to freeze the $USDC implicated in the incident. We can only hope that the funds are quickly returned to the rightful owners and that other platforms do their best to ensure that something like this does not happen to them in the near future. Some have even resorted to hiring white hat hackers and employing bug bounty programs.