Amun Hack

Amun issued index tokens that gave holders exposure to a basket of assets, rebalanced regularly and redeemable for the underlying tokens. On December 26, 2022, an attacker took control of the address Amun used to run rebalances for its PECO (Polygon Ecosystem Index) and DFI tokens and drained the underlying assets, worth about $300,000 at the time.

The address 0xd7948f06256831d1f0287d81bf1e6b19185aa69a was the only one allowed to rebalance the tokens, and Amun said it considered it compromised. The attacker created fake tokens and a fake exchange, pointed PECO's rebalance manager at that exchange, and forced a rebalance that swapped all the real underlying tokens for the fake ones, sending the real tokens to the attacker, who swapped them for MATIC. Amun said the attacker then minted 80 billion tokens and sold them on every available DEX, draining the liquidity pools. The same steps were repeated on DFI, which used the same rebalancer address. Amun has not said how the address was compromised.

Amun moved the manager contract under company multisig control. 21.co, Amun's parent company, set up a relief fund paying eligible PECO and DFI holders in USDC based on their balances at hack-time prices (PECO $2.60, DFI $0.61), and Amun proposed a governance vote to freeze the tokens on February 8, 2023 and later terminate them.

Attacker: 0xf8b17df4da32fafdda970ae1f76d2dbff7091913