Tornado

<p class="is-style-lead">A flash loan attack on the BNB Chain has resulted in the largest single arbitrage profit in its history, according to security experts.</p>
<p>The attacker exploited a price manipulation vulnerability on the BH token (BH) and made off with $1.27 million in USDT.</p>
<p>As reported by Chinese journalist Colin Wu on Oct. 11, the attacker used a bot to borrow a large amount of USDT from a lending platform and then manipulated the price of BH on PancakeSwap, a decentralized exchange on the BNB Chain.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">According to EigenPhi, on October 11, MEV Bot: 0x21…480C on BNB Chain made a profit of US$1.575 million through a flash loan attack on the Pancakeswap BH/USDT trading pair for only $4.16, becoming the largest single arbitrage profit in the history of BNB Chain. According to…</p>— Wu Blockchain (@WuBlockchain) <a href="https://twitter.com/WuBlockchain/status/1712313117563375912?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">October 12, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>The bot then swapped USDT for BH at a low price and removed liquidity from the BH/USDT pair at a high price, earning a massive profit in the process. The bot spent only $4.16 in fees for the attack and transferred all the profits to the crypto mixing service Tornado Cash.</p>
<p>You might also like: <a href="https://crypto.news/ftx-founder-sam-bankman-frieds-trial-day-6-recap/" rel="noopener noreferrer nofollow"> FTX founder Sam Bankman-Fried’s trial day 6: Recap </a></p>
<p>Beosin, a blockchain security company, explained the details of the attack on X. They said the attacker exploited a function in the BH contract that allowed them to add USDT to the contract without affecting the liquidity ratio.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><a href="https://twitter.com/search?q=%24BH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$BH</a> token on BNB Chain was exploited for ~$1.27M due to suspected price manipulation. The profits were sent into Tornado Cash.<br>Attacker: 0xFDbfcEEa1de360364084a6F37C9cdb7AaeA63464<br><br>The attacker flashloaned a large amount of <a href="https://twitter.com/search?q=%24USDT&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$USDT</a>, then called 0x33688938() to add <a href="https://twitter.com/search?q=%24USDT&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$USDT</a> to the… <a href="https://t.co/POppQswi7u" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/POppQswi7u</a></p>— Beosin Alert (@BeosinAlert) <a href="https://twitter.com/BeosinAlert/status/1712139760813375973?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">October 11, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>The contract assumed the liquidity ratio was about 1 USDT:100 BH. However, the attacker changed it to 1 USDT:2 BH by swapping USDT for BH through PancakeSwap. This way, the attacker could withdraw more USDT than they deposited.&nbsp;</p>
<p>Beosin warned that this was a premeditated attack on the BH token. Moreover, PeckShield, another blockchain security firm, <a href="https://twitter.com/PeckShieldAlert/status/1712115434802323564?" target="_blank" rel="noopener noreferrer nofollow">confirmed</a> on X that the address involved in the attack initially received funds from Tornado Cash.&nbsp;</p>
<p>In a flash loan <a href="https://crypto.news/avalanches-platypus-defi-suffers-8-5m-flash-loan-attack/" rel="noopener noreferrer nofollow">attack</a>, the attacker quickly borrows a large sum of an asset with no collateral from a DeFi lending platform, uses it to manipulate vulnerabilities in other protocols, and repays the loan within the same transaction, often resulting in significant profits at the expense of the targeted protocols.</p>
<p>Read more: <a href="https://crypto.news/hong-kongs-regulatory-approach-criticized-as-licensed-to-be-killed/" rel="noopener noreferrer nofollow"> Hong Kong’s regulatory approach criticized as “licensed to be killed” </a></p>

BNB Chain exploited in flash loan attack, attacker snags $1.27M

crypto.news

Other articles published on Oct 12, 2023

Ex-GirlFriend Unravels SBF’s Valiant Efforts to Unfreeze Chinese Funds

Kazakhstan Takes Bold Step Towards AI Advancement: Plans to Build AI Data Centers in Collaboratio...

Bitcoin Price Prediction: BTC Drops Almost 3% Following FOMC's Assertive Remarks; Awaits US CPI I...

Safest Bets In Crypto Are Likely Solana, Bitcoin Spark, And XRP

Lido Disclosed 20 Ethereum Staking Slashing Events Occurred on Oct.11

Tracking the Wise Investments: Weighing the Future of SUI, SPCT, and ETC

Join our free newsletter for daily crypto updates!