April

Tornado Cash

USDC

Read

Tornado

<div class="protos">
 <a rel="noopener noreferrer nofollow" title="Pike Finance" href="https://thebittimes.com/tag/pike-finance.html">Pike Finance</a> has been <a rel="noopener noreferrer nofollow" title="Hack" href="https://thebittimes.com/tag/hack.html">Hack</a>ed for the second time in four days, with losses across the two incidents totaling approximately $1.9 million.
 In response to the first hack, on April 26, the team immediately paused the protocol. However, this opened up a new vulnerability that was exploited between 21:45 and 22:20 (UTC) on April 30.
 Crypto security firm Ancilia quickly identified three malicious transactions on the Optimism, Arbitrum, and Ethereum networks. Ancilia states the attacker was able to ‘upgrade’ and take control of the <a rel="noopener noreferrer nofollow" title="Pike Finance" href="https://thebittimes.com/tag/pike-finance.html">Pike Finance</a> contracts, which allowed them to withdraw the funds held within.
 The stolen assets were swapped to ETH and consolidated in the attacker’s Ethereum address before being deposited into privacy protocol Railgun.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 the contract was upgraded by the attacker pic.twitter.com/EoXHem7MBj— Ancilia, Inc. (@AnciliaInc) April 30, 2024
 </blockquote>
 </div>
 </figure>
 Read more: Hackers switching to centralized exchanges to fund crypto attacks
 The hack was acknowledged by the Pike team on X (formerly Twitter). The post put the losses at approximately 64k OP ($150,000), 100k ARB ($105,000), and 480 ETH ($1.4 million) and admitted that the hack was related to the previous incident.
 The last time <a rel="noopener noreferrer nofollow" title="Pike Finance" href="https://thebittimes.com/tag/pike-finance.html">Pike Finance</a> was <a rel="noopener noreferrer nofollow" title="Hack" href="https://thebittimes.com/tag/hack.html">Hack</a>ed (three days ago), it suffered losses of around $300,000 worth of the USDC stablecoin. The resulting funds were swapped for ETH and transferred to the crypto-mixing service Tornado Cash.
 According to the earlier incident’s post-mortem report, the protocol was paused to prevent any further losses while the incident was investigated. The report also admits that the vulnerability had been reported by auditors OtterSec, but that the Pike team “was unable to address the identified vulnerability in a timely manner.”
 However, as described in today’s response to the second hack, pausing the contracts inadvertently introduced “an additional dependency within the smart contract code.” This led to a “misalignment in storage mapping” which the attacker could take advantage of, reinitializing the contract and assuming full control.
 <a rel="noopener noreferrer nofollow" title="Pike Finance" href="https://thebittimes.com/tag/pike-finance.html">Pike Finance</a> has offered a 20% bounty for the return of the funds and has promised to provide a “plan to make users whole.”
 The community’s opinions on this response can be seen in the Pike Finance Discord.
 <figure class="wp-block-image"><img decoding="async" src="https://thebittimes.com/image/getimage/?url=https://lh7-us.googleusercontent.com/docsz/AD_4nXdAnEfzBJwt7tS3R1W1vRjp3k9dv9Kbktlxwb1Jy8bTroqsiLcyW0kC7NTUKb9TLeFvQS3fjxTP7VL0zEGLhrsacFQLUCkM-_OhOoZgrL4iER7Z8QCoQ_5jEkdgCchxL2ckDYNK5nCjhUbV_dNGVDHjT2dB?key=UdeyZSePlEFr4v8PVZRAoQ" alt>
 </figure>
 Read more: Tornado Cash funds ‘at risk’ after hacker injects malicious code
 After being hit twice in a row, users are understandably upset, and some have suggested that Pike Finance refund pre-sale investments.
 This in itself has, predictably, opened up another potential attack vector as scam replies (impersonating the Pike Finance account) promise a refund to victims as part of a common phishing technique.
 Got a tip? Send us an email or ProtonMail. For more informed news, follow us on&nbsp;X,&nbsp;Instagram,&nbsp;Bluesky, and&nbsp;Google News, or subscribe to our&nbsp;YouTube&nbsp;channel.
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/defi-lender-pike-finance-loses-1-9m-to-two-hacks-in-less-than-a-week-tbt87162.html">https://thebittimes.com/defi-lender-pike-finance-loses-1-9m-to-two-hacks-in-less-than-a-week-tbt87162.html</a>

DeFi lender Pike Finance loses $1.9M to two hacks in less than a week

TheBitTimes

Other articles published on May 1, 2024

Internet Computer Accelerates Global Expansion Following Massive ICP Global Community Townhall

Meme Coin Bloodbath: Base, Solana Meme Cryptos Decimated

Renzo (REZ) plummets 43% after Binance listing and airdrop

XRP Lawyer John Deaton Slams SEC’s Gary Gensler For ‘Infecting’ Entire Agency

What is Sell in May and Go Away?

How Did Spot Bitcoin ETFs Perform in April?

Join our free newsletter for daily crypto updates!