DEUS Finance Hack

Deus Finance was exploited due to a logic flaw in the $DEI token contract. The attacker drained pools on both Arbitrum and Binance Smart Chain (BSC) chains resulting in a loss of 6,227,977 $USD.

DEI is a stablecoin of Deus Finance which lost its dollar peg on the previous hack. On May 5th, 2023 Deus Finance's $DEI token was exploited due to a logic flaw related to burn issue that allowed an attacker to drain DEI/USD and DEI/USDC pools on both Arbitrum and Binance Smart Chain (BSC) chains. The attacker performed zero-amount burns and received $DEI tokens for nothing, which was consequently swapped for valuable stablecoins. On BSC chain alone roughly 1,336,814 $USD was lost. The stolen funds were transferred through several EOA addresses and then swapped for $DAI. And 4,891,163 $USD were drained from the Arbitrum chain and swapped for 2,529 $ETH, which remain at the same address.

The attack resulted in a total loss of approximately 6,227,977 $USD worth of crypto assets from both chains combined.

Attacker initial address in BSC: https://bscscan.com/address/0x08e80ecb…98f599

Funds holder address in BSC: https://bscscan.com/address/0xdf610228…9cb465

Malicious transaction in Binance Smart Chain: https://bscscan.com/tx/0xde2c8718…a190c3

Attacker initial address in the Arbitrum chain: https://arbiscan.io/address/0x189cf534…b122d1

Malicious transaction in the Arbitrum chain: https://arbiscan.io/tx/0xb1141785…3c37ef