Convergence

2024

Satoshi

According to CertiK, an attacker’s account utilized an unreadable function to transfer $1.4m worth of BSC-USD without burning the equivalent LP tokens. The blockchain insights and security platform revealed that the BSC-USD was drained on September 10 from a liquidity pool holding CUT tokens.
CertiK claimed that the CUT token contract relied on a separate unverified contract to set its “future yield parameter,” allowing the extraction of the BSC-USD through mysterious methods in four separate transactions. According to CertiK, the exploited CUT token differed from the Crypto Unit project with the same ticker symbol but located at a different address ending in “36a7” on the Binance Smart Chain. The affected pair was “0x83681F67069A154815a0c6C2C97e2dAca6eD3249,” as per CertiK’s findings.&nbsp;&nbsp;
<h3 id="span-style-font-weight-400-exploit-with-cut-tokens-leads-to-over-1-4-million-in-losses-span">Exploit with CUT tokens leads to over $1.4 million in losses</h3>
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <a href="https://twitter.com/hashtag/CertiKInsight?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">#CertiKInsight</a> 🚨
 We have seen a flashloan exploit involving CUT token
 BSC: 0x7057F3b0F4D0649B428F0D8378A8a0E7D21d36a7
 The CUT contract uses ILPFutureYieldContract(_lpFutureYieldContractAddress) at 0x0917914b0A70ee7F1f2460Fcd487696856E31154 which is unverified and contains… <a href="https://t.co/ycE4Px3Nxy" rel="noopener noreferrer nofollow" target="_blank">pic.twitter.com/ycE4Px3Nxy</a>
 — CertiK Alert (@CertiKAlert) <a href="https://twitter.com/CertiKAlert/status/1833531143339012327?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">September 10, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
CertiK uncovered a flashloan exploit involving a CUT token contract using “ILPFutureYieldContract(_lpFutureYieldContractAddress) at 0x0917914b0A70ee7F1f2460Fcd487696856E31154,” which was unverified and contained hidden functionality. The crypto security platform affirmed that the attacker manipulated CUT using FutureYield to gain nearly $1.4 million from the BUSD-CUT pancake pair. CertiK confirmed that the funds were currently held at “0x5766d1F03378f50c7c981c014Ed5e5A8124f38A4.”
Certik disclosed that the drained pool was part of the Pancakeswap exchange, but no other Pancakeswap pools were affected. Blockchain data <a href="https://bscscan.com/address/0x5766d1f03378f50c7c981c014ed5e5a8124f38a4#tokentxns" rel="noopener noreferrer nofollow" target="_blank">revealed</a> that the attacker carried out four separate transactions to remove the $1,448,974 from a BSC-USD pool. CertiK asserted that it was alerted of the illegitimate transaction since the attacker neither made any deposits to the pool nor owned any liquidity provider tokens.&nbsp;
As per CertiK’s report, the attacker called the “0x7a50b2b8” function that did not exist in the token contract. The report unveiled that the attacker must have called “ILPFutureYieldContract(),” allowing the calling of another function on an entirely separate unverified contract with an address ending in “1154,” showing only an unreadable bytecode. In this case, CUT liquidity providers collectively lost $1.4m due to the exploit.
<h3 id="span-style-font-weight-400-crypto-exploits-on-the-rise-in-2024-with-over-310m-in-august-losses-span">Crypto exploits on the rise in 2024 with over $310M in August losses</h3>
Data from CertiK <a href="https://x.com/CertiKAlert/status/1829839311522464019" rel="noopener noreferrer nofollow" target="_blank">showed</a> that over $310 million was lost to a combination of hacks, scams, and exploits in August 2024. The data confirmed this was the second-highest monthly loss in 2024. According to the data, ~$0.8 million was lost to exit scams, ~$1.2 million to flash loans, and $308.8 million to exploits, while only $10.3 million had been recovered.&nbsp;
CertiK’s data revealed that phishing victims had lost a total of $293 million. Notably, top flash loan attacks in August resulted in losses for Vow ($1.2M), MintStakeShare ($33.5K), and Satoshi ($5K), while the top exit scams resulted in losses for Grimace token ($649K), Sigma (136K), and Mbappe token ($88K). The top exploits in August were experienced by the Ronin Network ($11.8M), Nexera (448.8K), Convergence ($210K), iVest DAO ($172K), and AAVE Periphery Ctr ($64K).
Immunefi disclosed that over $1.2 billion was lost to crypto hackers in 2024, representing a 15.5% rise compared to the same period in 2023.&nbsp;

Hacker uses unverified contract to drain $1.4m from CUT token pools

Table of Contents

Cryptopolitan_News

Other articles published on Sep 11, 2024

WazirX Hacker Resurfaces Moving $23 Million in Ethereum

FTX Bankruptcy Plan Faces Scrutiny as SEC Questions Stablecoin Payments

Musk X Empire: September 11 Daily Combo, Riddle, and Rebus

Weekly Article Recap: 8/26-8/30

PancakeSwap Launches "v4 Hookathon" to Enhance v4 Functionality

Trump and Harris Tied on Polymarket After Debate

Join our free newsletter for daily crypto updates!