Dough

Compound

DeFi

Online

Million

Another DeFi protocol fell victim to an exploit on Friday morning. Dough Finance, an open-source protocol to create non-custodial liquidity markets, suffered a flash loan attack that took nearly $2 million in user funds. The project’s team announced they are working to resolve the situation promptly. 
<h2 style="font-weight: 400;" id="dough-finance-protocol-loses-1-96-million">Dough Finance Protocol Loses $1.96 Million</h2> 
On July 12, online reports concerning activity from Dough Finance were called out. Web3 blockchain security platform Cyvers <a href="https://x.com/CyversAlerts/status/1811663035242553450" target="_blank" rel="noopener nofollow">informed</a> us that it had detected multiple suspicious transactions involving the DeFi protocol. 
Per the report, the hacker manipulated Dough Finance’s smart contract and stole $1.8 million in USDC. The attacker, funded through the zero-knowledge (ZK) protocol Railgun, swapped the misappropriated funds to Ethereum (ETH), initially obtaining 608 ETH. 
Olympix, a Web3 security provider, <a href="https://x.com/Olympix_ai/status/1811672882080010705" target="_blank" rel="noopener nofollow">revealed</a> that the exploit occurred due to “calldata within the ConnectorDeleverageParaswap contract.” Seemingly, the contract didn’t properly check the flash loan calls data. 
The unvalidated calldata allowed the exploiter to manipulate the contract’s data and send the funds to an Externally Owned Account (EAO). Following the initial reports, a second batch of <a href="https://bitcoinist.com/chinese-crypto-trader-loses-1-million-from-binance-after-chrome-plugin-exploit/" target="_blank" rel="noopener ">attacks</a> occurred. 
<img loading="lazy" decoding="async" class="size-large wp-image-310082 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=980&amp;resize=980%2C448" alt="Ethereum" width="980" height="448" srcset="https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=1664 1664w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=980&amp;resize=980%2C448 980w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=1536 1536w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=750 750w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSeWPUboAAKpsX.jpeg?w=1140 1140w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1"> 
These attacks resulted in the loss of another $141,000 in USDC, raising the total crypto heist to $1.96 million. Nonetheless, Cyvers confirmed that lending protocol Aave’s pools remained unaffected. 
<h2 style="font-weight: 400;" id="scammers-target-defi-projects">Scammers Target DeFi Projects</h2> 
After the initial reports, the DeFi protocol acknowledged the attack and urged users to withdraw their remaining funds from the protocol. Later, Dough Finance <a href="https://x.com/DoughFina/status/1811742461229752334" target="_blank" rel="noopener nofollow">announced</a> it had identified and closed the exploit. 
The project confirmed that “a few early Dough DeFi Smart Accounts (DSAs)” were victim to a sophisticated <a href="https://bitcoinist.com/crypto-investors-beware-coinbase-phishing-scam-swipes-1-7-million/" target="_blank" rel="noopener ">exploit</a>. Moreover, the post assured that Dough Finance’s team is actively working to address the incident, recover the funds, and make investors whole. 
Online reports revealed that the team reached out to the exploiter. In an on-chain message, the Defi protocol informed the exploiter it had contacted the appropriate authorities. 
<img loading="lazy" decoding="async" class="size-large wp-image-310083 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=980&amp;resize=980%2C261" alt="Ethereum" width="980" height="261" srcset="https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=1797 1797w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=980&amp;resize=980%2C261 980w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=1536 1536w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=750 750w, https://bitcoinist.com/wp-content/uploads/2024/07/GSSVw75WYAEF7DH.jpeg?w=1140 1140w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1"> 
The team also offered to discuss a bounty if the attacker had “exploited this vulnerability as a white or grey hat,” and attached the address where the funds should be directly transferred. 
The exploiter has until Monday, July 15, 2024, at 23:00 UTC to contact the DeFi protocol. Per the message, if the team doesn’t receive an answer, they will “assume you appropriated the funds with unlawful intent and will pursue all criminal, legal, and administrative avenues available” to recover the misappropriated funds. 
<a href="https://bitcoinist.com/illicit-crypto-flows-reach-100-billion-since-2019/" target="_blank" rel="noopener ">Scammers</a> have heavily targeted the sector. This week, various DeFi projects, including Compound Finance, were compromised in a phishing attack. Seemingly, the projects were victims of a DNS domain attack that redirected users to a fake website. 
The copy website was a drainer tool that could drain users’ funds if they interacted with it. As a result, the projects’ teams urged customers not to interact with the websites until further notice. 
<img loading="lazy" decoding="async" class="size-large wp-image-310081 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/07/ETHUSDT_2024-07-12_11-42-50.png?w=980&amp;resize=980%2C524" alt="Ethereum, ETH, ETHUSDT" width="980" height="524" srcset="https://bitcoinist.com/wp-content/uploads/2024/07/ETHUSDT_2024-07-12_11-42-50.png?w=1102 1102w, https://bitcoinist.com/wp-content/uploads/2024/07/ETHUSDT_2024-07-12_11-42-50.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/07/ETHUSDT_2024-07-12_11-42-50.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/07/ETHUSDT_2024-07-12_11-42-50.png?w=980&amp;resize=980%2C524 980w, https://bitcoinist.com/wp-content/uploads/2024/07/ETHUSDT_2024-07-12_11-42-50.png?w=750 750w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1">

DeFi Protocol Dough Finance Exploit Swipes $1.96 Million In User Funds

Table of Contents

Bitcoinist

Other articles published on Jul 13, 2024

Here’s how and why Toncoin’s [TON] Open Interest hit record highs

Why is Bitcoin up in the weekend? BTC stabilizes above $58K

BlockDAG Poised to Mint New Millionaires with a $20 Price Target! Insights on Kaspa & Dogecoin

Shiba Inu Price Increases with Wider Crypto Market

Is ZKSync (ZK) Preparing To Break Past Its All-Time High Again

Too few jurisdictions take proper virtual asset precautions: FATF

Join our free newsletter for daily crypto updates!