Penpie

Pendle

Tornado Cash

Tornado

On September 3, the decentralized finance (DeFi) protocol Penpie, built on Pendle, was hacked, resulting in the loss of $27 million in various cryptocurrencies.
The stolen funds included Ether (ETH) and stablecoins like wrapped USDC and sUSDE, according to&nbsp;<a style="text-decoration:none" href="https://x.com/EmberCN/status/1831137479245873403">EmberCN</a>. The hacker reportedly exploited a vulnerability in Penpie's security, converting most of the stolen assets into ETH and then transferring them to a new Ethereum address, making it difficult to trace.
<h2 dir="ltr" id="span-span-the-exploit-span-span">The Exploit</h2>
The hack was first brought to light by an X account,&nbsp;<a style="text-decoration:none" href="https://x.com/shoucccc/status/1831044487323529639?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1831044487323529639%7Ctwgr%5E54224178592e08d7747d7189aae76bb853341482%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fcoinpedia.org%2Fnews%2Fpenpie-protocol-got-exploited-lost-27-millions-in-funds%2F">Chaofan Shou</a>, affiliated with Fuzzland. The account reported that $17 million had been drained from Penpie, indicating that the protocol was unaware of the breach even after it had begun. This delay in response led to an additional $10 million in losses.&nbsp;
&nbsp;
The hacker exploited a specific security weakness in Penpie’s system, enabling them to drain funds swiftly and efficiently.
&nbsp;
Most of the stolen assets were converted into 11,109 ETH, worth approximately $26.95 million. Of this amount, the hacker laundered 1,000 ETH (about $2.42 million) through the crypto mixer Tornado Cash, per&nbsp;<a style="text-decoration:none" href="https://debank.com/profile/0x7a2f4d625fb21f5e51562ce8dc2e722e12a61d1b/history">DeBank data</a>. Blockchain data revealed that the exploiter's address was initially funded with 10 ETH from Tornado Cash just hours before the attack took place.
<h2 dir="ltr" id="span-span-response-from-penpie-and-pendle-span-span">Response from Penpie and Pendle</h2>
Penpie&nbsp;<a style="text-decoration:none" href="https://x.com/Penpiexyz_io/status/1831058385330118831">confirmed</a> the security breach in an X post approximately an hour after the hack began. The protocol immediately paused all deposits and withdrawals to prevent further losses.&nbsp;
<div>
 <blockquote class="twitter-tweet">
 Alert: Penpie has encountered a security compromise. We have paused all deposits and withdrawals. Our team is working tirelessly to address it. Your patience and support are invaluable during this time. Stay tuned for further updates.— Penpie (@Penpiexyz_io) <a href="https://twitter.com/Penpiexyz_io/status/1831058385330118831?ref_src=twsrc%5Etfw">September 3, 2024</a>
 </blockquote> 
</div>
Pendle, the platform on which Penpie is built, also&nbsp;<a style="text-decoration:none" href="https://x.com/pendle_fi/status/1831168623634993402">took action</a>. They paused all contracts on Pendle as a precautionary measure, safeguarding approximately $105 million that could have been at risk. Pendle confirmed that their funds were secure and that the breach was specific to Penpie, not affecting the Pendle protocol itself.
&nbsp;
Pendle's team identified the attack and mobilized efforts to protect their ecosystem. They reportedly reached out to security experts at Seal 911 to evaluate the situation and devise strategies to prevent further breaches.&nbsp;
<h2 dir="ltr" id="span-span-penpie-s-appeal-to-the-hacker-span-span">Penpie's Appeal to the Hacker</h2>
Penpie&nbsp;<a style="text-decoration:none" href="https://x.com/Penpiexyz_io/status/1831157212963598555?ref_src=twsrc%5Etfw">reached</a> out to the hacker with an offer to negotiate a bounty for the safe return of the stolen funds. Penpie emphasized that they would not pursue legal action if the funds were returned.&nbsp;
&nbsp;
They also offered the hacker an opportunity to transition into a white-hat role, where their skills would be recognized and rewarded. The protocol stressed the importance of the stolen funds to their community and expressed a willingness to resolve the issue cooperatively..
<h2 dir="ltr" id="span-span-aftermath-and-ongoing-developments-span-span">Aftermath and Ongoing Developments</h2>
As of the latest updates, Penpie’s stolen funds have been partially transferred to Tornado Cash, making recovery efforts more challenging. Penpie has reportedly repositioned their platform’s front-end and is actively working to ensure that users can securely withdraw their remaining funds.

Penpie DeFi Protocol Hacked, $27M in Crypto Stolen

Table of Contents

BSCN

Other articles published on Sep 9, 2024

[NEOPIN 3.0 Guide] Connect NEOPIN Wallet(WEB)

SEC to Crack Down on Unregulated Exchanges in Nigeria Soon

Binance Executives' Money Laundering Trial Advanced to September 2 in Nigeria Amid Controversy

These Chainlink Metrics Hit ATH, LINK Price Heading for A Rebound?

Panda Ling ($LING) Unveils TRON-Based Tap2Earn and Task2Earn Platform – Presale Event Announced (...

Scam Alert: Hackers Burn Tokens In Wallets, Here's How to Avoid It

Join our free newsletter for daily crypto updates!