What happened
Contract deployer exploited StrategyController smart contract, transferring funds to his wallet and hiding traces using Tornado Cash mixer.
The contract deployer exploited the StrategyController smart contract by invoking the inCaseTokensGetStuck() function. This allowed him to transfer funds directly into his wallet. The exploit was carried out in several transactions.
After acquiring the funds, the attacker used the Tornado Cash mixer to hide the traces of the stolen funds. This method of obscuring the origin of funds makes it difficult to track the attacker.
Malicious Transactions:
Tornado Cash Mixer Transaction:
Protocol details
Evidence
- report Post-mortem rekt.news
- report @CryptoCatVC incident report twitter.com
- report @defiyield_app incident report twitter.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
