Dough

Compound

DeFi

Online

Million

<a href="https://bitcoinworld.co.in/defi-protocol-dough-finance-exploit-swipes-1-96-million-in-user-funds/" title="DeFi Protocol Dough Finance Exploit Swipes $1.96 Million In User Funds" rel="nofollow"></a>
<ul> 
 <li style="font-weight: 400">Another DeFi protocol, Dough Finance, fell victim to an exploit on Friday morning, losing $1.96 Million in user funds.&nbsp;</li> 
</ul> 
Dough Finance, an open-source protocol to create non-custodial liquidity markets, suffered a flash loan attack that took $1.96 Million in user funds. The project’s team announced they are working to resolve the situation promptly. 
<h3 id="span-style-font-weight-400-dough-finance-protocol-loses-1-96-million-span">Dough Finance Protocol Loses $1.96 Million</h3> 
On July 12, online reports concerning activity from Dough Finance were called out. Web3 blockchain security platform Cyvers informed us that it had detected multiple suspicious transactions involving the DeFi protocol. 
Per the report, the hacker manipulated Dough Finance’s smart contract and stole $1.8 million in USDC. The attacker, funded through the zero-knowledge (ZK) protocol Railgun, swapped the misappropriated funds to Ethereum (ETH), initially obtaining 608 ETH. 
Olympix, a Web3 security provider, revealed that the exploit occurred due to “calldata within the ConnectorDeleverageParaswap contract.” Seemingly, the contract didn’t properly check the flash loan calls data. 
The unvalidated calldata allowed the exploiter to manipulate the contract’s data and send the funds to an Externally Owned Account (EAO). Following the initial reports, a second batch of attacks occurred. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">Exploit Alert<img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> 
 Dough Finance has been exploited for around $1.8M! The stolen funds are currently held in the externally owned accounts. 
 Check out the fund’s flow here: <a href="https://t.co/OvOJ79YEeV">https://t.co/OvOJ79YEeV</a><a href="https://twitter.com/hashtag/CryptoInvestigation?src=hash&amp;ref_src=twsrc%5Etfw">#CryptoInvestigation</a> <a href="https://twitter.com/hashtag/CryptoSecurity?src=hash&amp;ref_src=twsrc%5Etfw">#CryptoSecurity</a> <a href="https://t.co/gqib5jCxt3">pic.twitter.com/gqib5jCxt3</a> 
 — Breadcrumbs.app (@AppBreadcrumbs) <a href="https://twitter.com/AppBreadcrumbs/status/1811747498110656734?ref_src=twsrc%5Etfw">July 12, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
These attacks resulted in the loss of another $141,000 in USDC, raising the total crypto heist to $1.96 million. Nonetheless, Cyvers confirmed that lending protocol Aave’s pools remained unaffected. 
<h3 id="span-style-font-weight-400-scammers-target-defi-projects-span">Scammers Target DeFi Projects</h3> 
After the initial reports, the DeFi protocol acknowledged the attack and urged users to withdraw their remaining funds from the protocol. Later, Dough Finance announced it had identified and closed the exploit. 
The project confirmed that “a few early Dough DeFi Smart Accounts (DSAs)” were victim to a sophisticated exploit. Moreover, the post assured that Dough Finance’s team is actively working to address the incident, recover the funds, and make investors whole. 
Online reports revealed that the team reached out to the exploiter. In an on-chain <a href="https://x.com/CryptoEvgen/status/1811737649528422831">message</a>, the Defi protocol informed the exploiter it had contacted the appropriate authorities. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Dough Finance tries to contact the hacker. <a href="https://t.co/SjMpdgp6cc">pic.twitter.com/SjMpdgp6cc</a> 
 — Evgenii (@CryptoEvgen) <a href="https://twitter.com/CryptoEvgen/status/1811737649528422831?ref_src=twsrc%5Etfw">July 12, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The team also offered to discuss a bounty if the attacker had “exploited this vulnerability as a white or grey hat,” and attached the address where the funds should be directly transferred. 
The exploiter has until Monday, July 15, 2024, at 23:00 UTC to contact the DeFi protocol. Per the message, if the team doesn’t receive an answer, they will “assume you appropriated the funds with unlawful intent and will pursue all criminal, legal, and administrative avenues available” to recover the misappropriated funds. 
Scammers have heavily targeted the sector. This week, various DeFi projects, including Compound Finance, were compromised in a phishing attack.&nbsp; 
Seemingly, the projects were victims of a DNS domain attack that redirected users to a fake website. 
The copy website was a drainer tool that could drain users’ funds if they interacted with it. As a result, the projects’ teams urged customers not to interact with the websites until further notice.

DeFi Protocol Dough Finance Exploit Swipes $1.96 Million In User Funds

Table of Contents

ItsBitcoinWorld

Other articles published on Jul 14, 2024

New FDIC Leadership May Improve Bank-Crypto Interactions

Binance CEO Richard Teng Discusses Crypto’s Future and Challenges

German Government Unleashes 16,000 BTC On The Market, Will The US Government Follow Suit?

Transparency in BlockDAG’s Dashboard Leads to $58M Presale; Bitcoin Faces Downturns as BNB Prices...

Hedera Fails To Spark Investor Interest: Will It Crash More

MoonBag’s Top Meme Coin Presale raises $3.4Mn while Stacks and Cardano Battle Price Sinking and I...

Join our free newsletter for daily crypto updates!