Bounty

Arbitrum

Swap

Flash

<p>The post <a href="https://coinpedia.org/news/woofi-swap-exploited-with-8-75m-flash-loan-attack-10-bounty-offered-for-negotiation/">WOOFi Swap Hack: Flash Loan Exploit Steals $8.5 Million in WOO Tokens</a> appeared first on <a href="https://coinpedia.org">Coinpedia Fintech News</a></p> 
<p>Hackers executed a sophisticated attack on the sPMM algorithm, the heart of <a href="https://coinpedia.org/information/bitget-wallet-app-integrated-into-woofi-defi-protocol/">WOOFi Swap’s price</a> mechanism on the Arbitrum network on March 5th. Employing a clever pattern of flash loans, they deftly manipulated the value of WOO tokens, driving it perilously close to zero. </p> 
<p>But swift action from the WOOFi team, within a mere 13 minutes, curtailed the stolen amount at $8.5 million, preventing further escalation.</p> 
<h2 class="wp-block-heading" id="h-understanding-exploiter-s-tactics">Understanding Exploiter’s Tactics</h2> 
<p>Independent on-chain investigator, Spreek, detected the unusual transactions and promptly alerted the WooFi team. </p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Wootrade's WooPPV2 contract exploited for a total attacker haul of 8.5m on arbitrum. It is now paused, so no further action is needed.<br><br>(Deleted the previous post because it was spreading misinfo. I regret the error) <a href="https://t.co/BJCLTeKEYu">pic.twitter.com/BJCLTeKEYu</a></p>— Spreek (@spreekaway) <a href="https://twitter.com/spreekaway/status/1765046559832764886?ref_src=twsrc%5Etfw">March 5, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>In response, the team temporarily halted the affected pools, assuring users of a fully functional return within two weeks.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Heads up: we've paused these pools. We will follow up shortly with more updates. <a href="https://t.co/BlGEo3iYUf">https://t.co/BlGEo3iYUf</a></p>— WOOFi (@_WOOFi) <a href="https://twitter.com/_WOOFi/status/1765047837727891853?ref_src=twsrc%5Etfw">March 5, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>According to the team’s <a href="https://woo.org/blog/en/woofi-spmm-exploit-post-mortem">post-mortem analysis</a>, the exploiter borrowed 7.7 million WOO and other assets, selling the WOO into WOOFi. This action led to an erroneous adjustment in WOOFi’s sPMM, drastically reducing the WOO token’s value to near-zero.</p> 
<p>Did You Know? <a href="https://coinpedia.org/news/crypto-hackers-bag-200m-over-12-attacks-in-february-pushing-yearly-losses-to-67m/">Crypto Hack Round-up: Industry Loses $67 Million in February 2024</a></p> 
<h2 class="wp-block-heading" id="h-striking-gold-thrice">Striking Gold – Thrice! </h2> 
<p>Exploiting the glitch, the attacker exchanged 10 million WOO in the same transaction at almost no cost. This relentless assault was repeated three times in quick succession, yielding a staggering $8.75 million in profits after repaying the flash loans.</p> 
<h2 class="wp-block-heading" id="h-moving-away-from-stability">Moving Away from Stability </h2> 
<p>Unlike its uneventful journey since the 2021 launch, WOOFiSwap faced unprecedented challenges in this latest ordeal. The integration of lending markets for WOO in Arbitrum, coupled with limited liquidity elsewhere, presented a golden opportunity for hacking. </p> 
<p>Despite being deployed across 10+ networks, the absence of both the WOO token and the WOO lending market in other chains acted as a crucial barrier, preventing the replication of the exploits.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">3/ We have already initiated efforts to retrieve these funds, with a 10% whitehat bounty extended to the exploiter. Additionally, a bounty has been placed on <a href="https://twitter.com/ArkhamIntel?ref_src=twsrc%5Etfw">@ArkhamIntel</a> for anyone who can provide additional information.<a href="https://t.co/oSG0CQa4oP">https://t.co/oSG0CQa4oP</a></p>— WOOFi (@_WOOFi) <a href="https://twitter.com/_WOOFi/status/1765150691331281219?ref_src=twsrc%5Etfw">March 5, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="h-on-the-road-to-recovery">On the Road to Recovery </h2> 
<p>As of now, the WOOFi team is tirelessly working to recover the lost funds. Offering a substantial 10% white hat bounty, they have initiated on-chain negotiations with the hacker. Simultaneously, a reward has been posted on Arkham Intelligence for any valuable information leading to the identification of the hackers.</p> 
<p>Read More: <a href="https://coinpedia.org/news/from-fake-airdrops-to-rug-pulls-a-roundup-of-this-weeks-major-crypto-hacks/">Crypto Hacks of the Week: Breaches, Scams, and Rug Pulls Rock the Market</a></p> 
<p>What next? Stay tuned. </p>

WOOFi Swap Hack: Flash Loan Exploit Steals $8.5 Million in WOO Tokens

Table of Contents

CoinPedia News

Other articles published on Mar 6, 2024

MAGA (TRUMP) Coin May Catch Up To DOGE/SHIB With 700% Growth In The Past Month

Exploring Bitcoin’s Next Halving Effect on NFT Market Growth

Arizona Senate Reviews Bill to Add Bitcoin ETFs to Pension Investments

SEC Officials Challenge Agency’s Approach to Digital Asset Oversight

Fintech Revolut integrates with MetaMask for in-app crypto purchases

Cryptocurrency Stellar Falls More Than 3% In 24 hours

Join our free newsletter for daily crypto updates!