Dough

Aave

Tornado Cash

Pancake Bunny

Security

Decentralized finance (DeFi) protocol Dough Finance lost $1.8 million in digital assets after a flash loan attack on the protocol.&nbsp;
On July 12, Web3 security firm Cyvers <a href="https://x.com/CyversAlerts/status/1811663035242553450" target="_blank" rel="noopener nofollow">flagged</a> that i had detected multiple suspicious transactions. The company communicated with lending protocol Aave to check if pools were affected. However, the security firm confirmed that pools within Aave were safe. 
Despite this, Dough Finance suffered the brunt of the attack. According to Cyvers, the attacker was funded through the zero-knowledge (ZK) protocol Railgun and swapped the stolen USD Coin (<a href="https://cointelegraph.com/usdc-price-index">USDC</a>) for Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>). The attacker got a total of 608 ETH, worth about $1.8 million. 
<h2 id="hacker-manipulates-smart-contract">Hacker manipulates smart contract</h2>
Web3 security provider Olympix <a href="https://x.com/Olympix_ai/status/1811672882080010705" target="_blank" rel="noopener nofollow">highlighted</a> that the exploit was due to unvalidated call data within the “ConnectorDeleverageParaswap” contract. The firm explained: 
<blockquote data-ct-non-breakable="true">
 “The contract didn’t properly check the data it received during flash loan calls, allowing the attacker to manipulate it for their benefit.”
</blockquote>
Because of this, the attacker was able to manipulate the data and steal the funds. 
Olympix said those who deposited funds in the DeFi protocol’s exploited contract might be impacted. However, the security provider noted that the hack did not impact Aave pools. 
The security provider also advised Dough Finance users to consider withdrawing their funds to a secure wallet. Furthermore, they urged users to monitor announcements from the Dough Finance team and avoid interacting with the protocol until the situation is resolved. 
Related: <a href="https://cointelegraph.com/news/stolen-pancakebunny-funds-tornado-cash-dormancy">Pancake Bunny hacker siphons $2.9M of Ether through Tornado Cash</a>
<h2 id="over-1-billion-lost-to-security-incidents-in-2024">Over $1 billion lost to security incidents in 2024</h2>
While the Dough Finance hack losses only amounted to almost $2 million, the rest of the crypto space has already lost more than $1 billion in digital assets because of various incidents within the space. 
On July 3, blockchain security company CertiK published its security report, highlighting that losses on onchain incidents already <a href="https://cointelegraph.com/news/certik-report-crypto-losses-h1-2024">reached $1.19 billion</a> in the first half of 2024. Most of the losses were attributed to phishing attacks and private key compromises. 
According to CertiK, the space lost almost $500 million to phishing attacks, while private key compromises resulted in almost $409 million in losses. 
CertiK co-founder Ronghui Gu highlighted the urgent need to implement multifactor authentication methods, such as two-factor authentication (2FA) and security keys. 
Magazine: <a href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>

Dough Finance loses $1.8M in flash loan attack

Table of Contents

Cointelegraph

Other articles published on Jul 12, 2024

Amidst AAVE’s High Fees and Bluzelle’s Volatility, MoonBag Delivers Best Crypto Presale in 2024

New Development in Binance and Nigeria Tension! US Congress Members Called for Binance Executive!

Market Conditions Lead to Altcoin Weakness Despite Positive On-Chain Data

$1Million Raised! Rollblock (RBLK) Presale Continues To Dominate As Litecoin (LTC) Slides, Does P...

Mantra (OM) price hits ATH as staking reward rises to 21%

Biden Press Conference Highlight: Retiring Is Not The Plan, Says President

Join our free newsletter for daily crypto updates!