DFX Finance Hack

DFX Finance was exploited due to a flashloan vulnerability. The attacker siphoned off 4,445,279 $USD worth of assets, and an MEV bot was able to frontrun the hacker for the additional 3,200,000 $USD.

DFX Finance is a trading protocol providing flash loans. The attacker drained 4,445,279 $USD worth of assets in various tokens and transferred 2962 $ETH through Tornado Cash. 545,312 $USD worth of $CADC stays at the attacker's address, and 135,265 $USD worth of $TRYb remains at the malicious contract used for an attack.

The malicious actor exploited a known smart contract vulnerability that allows passing the balance check after a flashloan and gives approval of tokens to the attacker. The MEV bot was able to frontrun the hacker during token transfers for an additional 3,200,000 $USD in $USDC, $NZDS, $CADC, and $GYEN tokens. The DFX team claims that they are contacting the MEV bot owners to return the lost funds.

Attacker address:

https://etherscan.io/address/0x14c19962…b9a067

Malicious contract:

https://etherscan.io/address/0x6cfa86a3…41f22d

MEV bot:

https://etherscan.io/address/0xfde0d157…81455a

Malicious transactions list:

https://etherscan.io/txs?a=0x6cfa86a3…41f22d