What happened
The hacker's address on Ethereum:
BSC:
Polygon:
The transaction behind the attack on the BSC:
The hacker:
- Created a token contract (X token) with a modified transfer function:
- Created pools for X tokens and deposited liquidity
- Provided collateral (USDT, DAI, USDC, etc)
- Borrowed X tokens and real tokens (PIE and others) and with a modified transfer function in X token, could able to borrow more than he provided as collateral
- After that from his second account he liquidated loans of X tokens in the first account thereby returning the collateral
- Repeated with each pool.
Stolen funds were deposited into Tornado Cash and Typhoon mixers.
Protocol details
Classification
Yield Aggregator / Reentrancy
Protocol Type
Exploit/Other
Affected asset / contract
PIE
Implementation language
Solidity
Protocol links
Website
@defipiepie
Evidence
- report Post-mortem medium.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
