Dough

Aave

Railgun

Bitcoin

Flash

Decentralized finance (DeFi) protocol <a href="https://www.dough.finance/" data-wpel-link="external" target="_blank" rel="noopener noreferrer nofollow">Dough Finance</a> lost $1.8 million in digital assets following a flash loan attack.
On July 12, Web3 security firm Cyvers flagged multiple suspicious transactions, collaborating with lending protocol Aave to check for potential impacts on its pools. Cyvers confirmed that Aave’s pools were not affected.
However, Dough Finance bore the brunt of the attack. Cyvers reported that the attacker used the zero-knowledge (ZK) protocol Railgun to fund their operation, swapping the stolen USD Coin for Ether.
The total amount stolen was 608 ETH, equivalent to approximately $1.8 million.
Olympix, another Web3 security provider, explained that the exploit resulted from unvalidated calldata within the “ConnectorDeleverageParaswap” contract.
The firm elaborated:
“The contract didn’t properly check the data it received during flash loan calls, allowing the attacker to manipulate it for their benefit.”
This vulnerability allowed the attacker to manipulate data and steal the funds.
Olympix warned that depositors in the exploited contract could be affected but reassured that Aave pools remained secure.
READ MORE: <a href="https://www.cryptointelligence.co.uk/bitcoin-long-term-holders-remain-resilient-amid-deepest-correction-of-current-price-cycle/" data-wpel-link="internal" rel="noopener noreferrer nofollow">Bitcoin Long-Term Holders Remain Resilient Amid Deepest Correction of Current Price Cycle</a>
They advised Dough Finance users to withdraw their funds to secure wallets and to stay alert for updates from the Dough Finance team, avoiding interaction with the protocol until the issue is resolved.
Although Dough Finance’s losses were close to $2 million, the broader crypto space has faced over $1 billion in digital asset losses from various incidents.
On July 3, blockchain security firm CertiK published a report revealing that onchain incidents had already caused $1.19 billion in losses in the first half of 2024.
Phishing attacks and private key compromises were the primary culprits, with phishing attacks alone accounting for nearly $500 million and private key compromises for almost $409 million.
CertiK co-founder Ronghui Gu emphasized the need for enhanced security measures, including multifactor authentication methods such as two-factor authentication (2FA) and security keys, to protect against such substantial losses.
To submit a <a href="https://www.cryptointelligence.co.uk/category/press-releases/" data-wpel-link="internal" rel="noopener noreferrer nofollow">crypto press release (PR)</a>, send an email to <a href="mailto:sales@cryptointelligence.co.uk" rel="noopener noreferrer nofollow">sales@cryptointelligence.co.uk</a>.

Dough Finance Loses $1.8 Million in Flash Loan Attack Amid Rising Crypto Security Breaches

Crypto Intelligence

Other articles published on Jul 13, 2024

How did MakerDAO’s $1 billion program spur MKR’s price rally?

XRP Shows Signs of Bullish Breakout Amidst Forming Falling Wedge

SEC Ends Hiro Systems Probe With No Enforcement Action

BlastUP Announces Massive 30,000,000 $BLASTUP Airdrop Ahead of July TGE

African countries go crazy for the BRICS

Looking into why Bitcoin did not respond to June’s CPI report

Join our free newsletter for daily crypto updates!