Dough

Compound

DeFi

Online

Million

<a href="https://bitcoinworld.co.in/defi-protocol-dough-finance-exploit-swipes-1-96-million-in-user-funds/" title="DeFi Protocol Dough Finance Exploit Swipes $1.96 Million In User Funds" rel="nofollow"></a>
<ul> 
 <li style="font-weight: 400">Another DeFi protocol, Dough Finance, fell victim to an exploit on Friday morning, losing $1.96 Million in user funds.&nbsp;</li> 
</ul> 
Dough Finance, an open-source protocol to create non-custodial liquidity markets, suffered a flash loan attack that took $1.96 Million in user funds. The project’s team announced they are working to resolve the situation promptly. 
<h3 id="span-style-font-weight-400-dough-finance-protocol-loses-1-96-million-span">Dough Finance Protocol Loses $1.96 Million</h3> 
On July 12, online reports concerning activity from Dough Finance were called out. Web3 blockchain security platform Cyvers informed us that it had detected multiple suspicious transactions involving the DeFi protocol. 
Per the report, the hacker manipulated Dough Finance’s smart contract and stole $1.8 million in USDC. The attacker, funded through the zero-knowledge (ZK) protocol Railgun, swapped the misappropriated funds to Ethereum (ETH), initially obtaining 608 ETH. 
Olympix, a Web3 security provider, revealed that the exploit occurred due to “calldata within the ConnectorDeleverageParaswap contract.” Seemingly, the contract didn’t properly check the flash loan calls data. 
The unvalidated calldata allowed the exploiter to manipulate the contract’s data and send the funds to an Externally Owned Account (EAO). Following the initial reports, a second batch of attacks occurred. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">Exploit Alert<img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> 
 Dough Finance has been exploited for around $1.8M! The stolen funds are currently held in the externally owned accounts. 
 Check out the fund’s flow here: <a href="https://t.co/OvOJ79YEeV">https://t.co/OvOJ79YEeV</a><a href="https://twitter.com/hashtag/CryptoInvestigation?src=hash&amp;ref_src=twsrc%5Etfw">#CryptoInvestigation</a> <a href="https://twitter.com/hashtag/CryptoSecurity?src=hash&amp;ref_src=twsrc%5Etfw">#CryptoSecurity</a> <a href="https://t.co/gqib5jCxt3">pic.twitter.com/gqib5jCxt3</a> 
 — Breadcrumbs.app (@AppBreadcrumbs) <a href="https://twitter.com/AppBreadcrumbs/status/1811747498110656734?ref_src=twsrc%5Etfw">July 12, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
These attacks resulted in the loss of another $141,000 in USDC, raising the total crypto heist to $1.96 million. Nonetheless, Cyvers confirmed that lending protocol Aave’s pools remained unaffected. 
<h3 id="span-style-font-weight-400-scammers-target-defi-projects-span">Scammers Target DeFi Projects</h3> 
After the initial reports, the DeFi protocol acknowledged the attack and urged users to withdraw their remaining funds from the protocol. Later, Dough Finance announced it had identified and closed the exploit. 
The project confirmed that “a few early Dough DeFi Smart Accounts (DSAs)” were victim to a sophisticated exploit. Moreover, the post assured that Dough Finance’s team is actively working to address the incident, recover the funds, and make investors whole. 
Online reports revealed that the team reached out to the exploiter. In an on-chain <a href="https://x.com/CryptoEvgen/status/1811737649528422831">message</a>, the Defi protocol informed the exploiter it had contacted the appropriate authorities. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Dough Finance tries to contact the hacker. <a href="https://t.co/SjMpdgp6cc">pic.twitter.com/SjMpdgp6cc</a> 
 — Evgenii (@CryptoEvgen) <a href="https://twitter.com/CryptoEvgen/status/1811737649528422831?ref_src=twsrc%5Etfw">July 12, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The team also offered to discuss a bounty if the attacker had “exploited this vulnerability as a white or grey hat,” and attached the address where the funds should be directly transferred. 
The exploiter has until Monday, July 15, 2024, at 23:00 UTC to contact the DeFi protocol. Per the message, if the team doesn’t receive an answer, they will “assume you appropriated the funds with unlawful intent and will pursue all criminal, legal, and administrative avenues available” to recover the misappropriated funds. 
Scammers have heavily targeted the sector. This week, various DeFi projects, including Compound Finance, were compromised in a phishing attack.&nbsp; 
Seemingly, the projects were victims of a DNS domain attack that redirected users to a fake website. 
The copy website was a drainer tool that could drain users’ funds if they interacted with it. As a result, the projects’ teams urged customers not to interact with the websites until further notice.

DeFi Protocol Dough Finance Exploit Swipes $1.96 Million In User Funds

Table of Contents

ItsBitcoinWorld

Other articles published on Jul 14, 2024

A Mysterious Cryptocurrency Wallet Purchased a Large Amount of Ethereum (ETH) from Binance! Justi...

Next Cryptocurrency to Explode Sunday, July 14 — MAGA, Aerodrome Finance, Mog Coin, Bittensor

4 Cryptos Cheaper Than a Latte for 3000% ROI

Bitcoin Alternatives Pumping Higher: Avalanche (AVAX), Polkadot (DOT) And A Fresh New Memecoin

MoonBag Steals the Spotlight from Avalanche, Injective with Top Crypto Presale in 2024

MoonBag Meme Coin Attracts Investors Seeking Stability, Leaving Behind Slothana’s Fluctuations an...

Join our free newsletter for daily crypto updates!