DeFiPie Hack

The hacker's address on Ethereum:

https://etherscan.io/address/0xf6f43f77…6c0fe1

BSC:

https://bscscan.com/address/0xf6f43f77…6c0fe1

Polygon:

https://polygonscan.com/address/0xce1f4b4f…ff6ede

The transaction behind the attack on the BSC:

https://bscscan.com/tx/0x45f6f792…9c6d75

The hacker:

- created a token contract (X token) with a modified transfer function:

https://etherscan.io/token/0xf8dFD22A…966e4B#readContract

https://etherscan.io/token/0xb5337f26…6362Ef

- created pools for X tokens and deposited liquidity

- provided collateral (USDT, DAI, USDC, etc)

- borrowed X tokens and real tokens (PIE and others) and with a modified transfer function in X token, could able to borrow more than he provided as collateral

- after that from his second account he liquidated loans of X tokens in the first account thereby returning the collateral

- repeated with each pool.

Stolen funds were deposited into Tornado Cash and Typhoon mixers.