Reports said that Zabu Finance, a decentralized finance (DeFi) application on the Avalanche blockchain, has been exploited for crypto tokens worth $3.2 million. The removal of a large number of tokens eventually reduced the value of Zabu tokens to zero.
It has been reported that Zabu announced the exploit by asking for help from Avalanche and popular Avalanche-hosted decentralized exchanges such as Pangolin and Trader Joe.
It stated:
“Zabu Team Wallet has not sold a single Zabu. We're under an exploit, possibly from Spore Pool. We're investigating the exploit. Need help Pangolin, Trader Joe, Avalanche.”
However, based on further investigation, Zabu found the attacker stole the assets from a pool of Spore tokens which, according to the blockchain explorer, included 402.9 Wrapped Ether (WETH), 23,157 Wrapped AVAX (WAVAX), 21,501 Pangolen (PNG), 106,848 Avaware (AVE), 361,267 Tether (USDT) and 23,958.93 JOE (JOE), all amounting to $3.2 million at the time of exploit.
The report said that Zabu confirmed that the attacker was able to interact with the blockchain contracts and “successfully pulled out 4.5 billion Zabu tokens from Zabu Farm Contract, dumped all to Pangolin LPs and Trader Joe LPs of Zabu, stole around $600K.”
Soon after the exploit, Zabu and an Avalanche-hosted DeFi tool, Yield Yak, advised investors to withdraw their holdings or risk losing their assets to the attacker. As a part of remediation, Zabu intends to return tokens to investors based on their balances before and after the hack.
Zabu added:
“The process of Snapshot might take time as we need to calculate balances of Zabu Holders, Farm Stakers (for Zabu-related Pools) and AutoFarm Stakers (for Zabu-related Pools). We might need help Markr, DeBank and Avalanche.”
Likewise, Zabu has also burned the remaining 93.12 million Zabu tokens, which were worth $360,000. On August 30, yet another DeFi project xToken reported a cyberattack, resulting in a loss of nearly $4.5 million.
According to a report, the hacker went through an elaborate process of token swaps which involved taking a flash loan from the dYdX decentralized exchange for 25,000 ETH (around $81 million) to carry out the attack.
Thus, in the aftermath, xToken pulled the plug on xSNX product citing “significant surface area for vulnerabilities.”
Source: Cointelegraph