Dough

Aave

Tornado Cash

Pancake Bunny

Security

Decentralized finance (DeFi) protocol Dough Finance lost $1.8 million in digital assets after a flash loan attack on the protocol.&nbsp;
On July 12, Web3 security firm Cyvers <a href="https://x.com/CyversAlerts/status/1811663035242553450" target="_blank" rel="noopener nofollow">flagged</a> that i had detected multiple suspicious transactions. The company communicated with lending protocol Aave to check if pools were affected. However, the security firm confirmed that pools within Aave were safe. 
Despite this, Dough Finance suffered the brunt of the attack. According to Cyvers, the attacker was funded through the zero-knowledge (ZK) protocol Railgun and swapped the stolen USD Coin (<a href="https://cointelegraph.com/usdc-price-index">USDC</a>) for Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>). The attacker got a total of 608 ETH, worth about $1.8 million. 
<h2 id="hacker-manipulates-smart-contract">Hacker manipulates smart contract</h2>
Web3 security provider Olympix <a href="https://x.com/Olympix_ai/status/1811672882080010705" target="_blank" rel="noopener nofollow">highlighted</a> that the exploit was due to unvalidated call data within the “ConnectorDeleverageParaswap” contract. The firm explained: 
<blockquote data-ct-non-breakable="true">
 “The contract didn’t properly check the data it received during flash loan calls, allowing the attacker to manipulate it for their benefit.”
</blockquote>
Because of this, the attacker was able to manipulate the data and steal the funds. 
Olympix said those who deposited funds in the DeFi protocol’s exploited contract might be impacted. However, the security provider noted that the hack did not impact Aave pools. 
The security provider also advised Dough Finance users to consider withdrawing their funds to a secure wallet. Furthermore, they urged users to monitor announcements from the Dough Finance team and avoid interacting with the protocol until the situation is resolved. 
Related: <a href="https://cointelegraph.com/news/stolen-pancakebunny-funds-tornado-cash-dormancy">Pancake Bunny hacker siphons $2.9M of Ether through Tornado Cash</a>
<h2 id="over-1-billion-lost-to-security-incidents-in-2024">Over $1 billion lost to security incidents in 2024</h2>
While the Dough Finance hack losses only amounted to almost $2 million, the rest of the crypto space has already lost more than $1 billion in digital assets because of various incidents within the space. 
On July 3, blockchain security company CertiK published its security report, highlighting that losses on onchain incidents already <a href="https://cointelegraph.com/news/certik-report-crypto-losses-h1-2024">reached $1.19 billion</a> in the first half of 2024. Most of the losses were attributed to phishing attacks and private key compromises. 
According to CertiK, the space lost almost $500 million to phishing attacks, while private key compromises resulted in almost $409 million in losses. 
CertiK co-founder Ronghui Gu highlighted the urgent need to implement multifactor authentication methods, such as two-factor authentication (2FA) and security keys. 
Magazine: <a href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>

Dough Finance loses $1.8M in flash loan attack

Table of Contents

Cointelegraph

Other articles published on Jul 12, 2024

Ex OpenAI Employee Resigns to Avoid “Working for the Titanic of AI”

Russian Ministry of Finance Proposes Crypto Trading for Select Investors

Ethereum Price Prediction: As Top Analyst Sees Up to $10 Billion In ETH ETF Inflows, Traders Rush...

Bitcoin RSI at 48.90 Signals Potential for Price Rebound After Correction

Jack Dorsey’s Bitcoin Vision: How Block’s Mining Deal Fits into the Bigger Picture

BlockDAG Team Reveal Scheduled for July 29: Anticipate a 40% Increase in Value, ETH ETF Approval ...

Join our free newsletter for daily crypto updates!