Penpie

Dollar

DeFi

Ronin

Coin

An attacker drained over $1.4 million worth of Bows Coin Synthetic US Dollar (BSC-USD) from a liquidity pool holding CUT tokens on Sept. 10, according to a report from blockchain security platform CertiK. 
The CUT token contract relied on a separate, unverified contract to set its “future yield” parameter, and this separate contract was used to drain the BSC-USD through an unknown method.
CertiK reported the event on X.
<figure>
 <img alt="Attacker drains $1.4M from CUT token pools via mysterious unverified contract" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191e066-6964-7532-bdec-7addc359cdaa">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/CertiKAlert/status/1833531143339012327" rel="null" target="null" text="null" title="https://x.com/CertiKAlert/status/1833531143339012327">CertiK</a>
 </figcaption>
</figure>
The CUT token that was exploited is located at an address ending in 36a7 on BNB Smart Chain and is separate from the Crypto Unity project, which has the same ticker symbol but a different address.
The drained pool was part of the PancakeSwap exchange. No other PancakeSwap pools have reportedly been affected by it.
Blockchain data shows that the attacker&nbsp;<a data-ct-non-breakable="null" href="https://bscscan.com/address/0x5766d1f03378f50c7c981c014ed5e5a8124f38a4#tokentxns" rel="null" target="null" text="null" title="null">made</a>&nbsp;four separate transactions, draining the pool of BSC-USD and removing $1,448,974.
<figure>
 <img alt="Attacker drains $1.4M from CUT token pools via mysterious unverified contract" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191e067-322b-7fc7-865a-aee3bbca0958">
 <figcaption style="text-align: center;">
 CUT exploit transactions. Source: BscScan
 </figcaption>
</figure>
The attacker did not previously make any deposits to the pool and did not own any liquidity provider tokens for it, making it unlikely that the transaction was a legitimate withdrawal.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/penpie-defi-hack-27m-euler-hacker-message" rel="" target="_self" text="null" title="https://cointelegraph.com/news/penpie-defi-hack-27m-euler-hacker-message">Hacker praised after $27M crypto heist from Penpie DeFi protocol</a>
In each transaction, the attacker called a function named “0x7a50b2b8.” However, it does not exist in the token contract. 
According to the report, this implies that the attacker must have called ILPFutureYieldContract(), which allows the user to call a separate function on an entirely different contract whose address ends in 1154. This separate contract is unverified, and BscScan <a data-ct-non-breakable="null" href="https://bscscan.com/address/0x0917914b0a70ee7f1f2460fcd487696856e31154#code" rel="null" target="null" text="null" title="null">shows</a> only unreadable bytecode for it.
<figure>
 <img alt="Attacker drains $1.4M from CUT token pools via mysterious unverified contract" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191e068-0a72-760a-a581-42a98bef9d34">
 <figcaption style="text-align: center;">
 Separate contract used in CUT exploit. Source: BscScan
 </figcaption>
</figure>
Cointelegraph could not find any marketing website or Twitter account promoting CUT, and investors may have confused it with the unrelated Crypto Unity project.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/pythia-finance-drained-53k-crypto-sec/" rel="null" target="null" text="null" title="https://cointelegraph.com/magazine/pythia-finance-drained-53k-crypto-sec/">2 auditors miss $27M Penpie flaw, Pythia’s ‘claim rewards’ bug: Crypto-Sec</a>
Exploits are a common way for Web3 users to lose funds. On Sept. 3, over $25 million worth of crypto was <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/penpie-protocol-exploited-suffers-27-million-loss" rel="null" target="null" text="null" title="null">lost in an exploit</a> of the Penpie decentralized finance protocol. On Aug. 6, the bridge for the Ronin gaming network was <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/ronin-bridge-hack-upgrade-script-verichains" rel="null" target="null" text="null" title="null">drained of $10 million</a> after an attacker took advantage of a faulty deployment script. In this case, CUT liquidity providers are collectively $1.4 million poorer due to the exploit.

Attacker drains $1.4M from CUT token pools via mysterious unverified contract

Cointelegraph

Other articles published on Sep 11, 2024

Allegiance Oil & Gas with Over $1B in AUM Offers First Mineral Vault on Plume Network (11 Sep)

$277 Million in Ethereum (ETH) Shifts Hands: Details

Vitalik Buterin Stuns Community With Controversial Bull Posting Amid Ethereum Sales

Best Crypto to Buy Right Now September 10 – Conflux, Ondo, Sui

Spot Bitcoin ETFs Break 8-Day Outflow Trend With $117M Inflow

EasyA Hits 1 Million Downloads, Becomes Key Platform for Polkadot Developer Education

Join our free newsletter for daily crypto updates!