Onyx Protocol Lost $2.1 Million In a Latest Exploit

The attacker took a flashloan of 4,000 ETH from Aave to exploit the known bug in Onyx’s liquidity markets.

Last updated: November 1, 2023 12:39 PM

Published November 1, 2023 12:39 PM

Last updated: November 1, 2023 12:39 PM

Published November 1, 2023 12:39 PM

Decentralized liquidity market, Onyx has become victim of a latest DeFi exploit with attackers draining approximately $2.1 million from the protocol.

The exploit is associated with the oPEPE market on Onyx which was abused depositing funds to borrow from other markets.

After borrowing funds from Onyx’s cross-token liquidity markets, the Attacker managed to redeem deposited assets by exploiting the rounding issue, according to blockchain security firm – PeckShield.

The @OnyxProtocol hack leads to ~$2.1M loss by exploiting a known rounding issue behind the popular CompoundV2 fork.

Basically, the exploited oPEPE market was deployed 5 days ago without any liquidity. This empty market was abused with donation to borrow funds from other… https://t.co/ijkXbOyYr2 pic.twitter.com/fbHdZhTz0E
— PeckShield Inc. (@peckshield) November 1, 2023

The attacker carried out the hack by creating a flashloan of 4,000 ETH from Aave and swapped it to PEPE prior to exploiting the oPEPE smart contract on Onyx.

Onyx’s community leader confirmed that the protocol has lost a total of 1,163 ETH in the exploit. The team has now closed vulnerability and is working to proceed further.

The @OnyxProtocol experienced an exploit: https://t.co/4feaaEipfF. Fund loss is 1,163.53 ETH ~$2.1mln.
We are aware of the situation, closed the vulnerability, and working on the consequences with our partners.
— Web3, privacy & open-source advocate (@al_onyxprotocol) November 1, 2023

PeckShield said that the same bug was exploited earlier in the Hundred Finance hack which caused a loss of $7 million to the protocol. The exploit is originated from an old forked version of Compound V2, which was incorporated by Onyx.

All the stolen assets consisting of 1,130 ETH are now sent to crypto mixer Tornado Cash by the exploiter.

Also read: Unibot Confirms Being Exploited, Token Drops Over 30%

Disclaimer: The information researched and reported by The Crypto Times is for informational purposes only and is not a substitute for professional financial advice. Investing in crypto assets involves significant risk due to market volatility. Always Do Your Own Research (DYOR) and consult with a qualified Financial Advisor before making any investment decisions.

Follow The Crypto Times on Google News to Stay Updated!