LunaFI Hack

LunaFI, a Polygon-based project, was exploited resulting in the loss of 1,500,000 $LFI tokens worth around 36,362 $USD.

LunaFI is a betting platform running on Polygon. LunaFI's vLFI contract rewarding system was exploited. The attacker found an issue with the claimRewards() function that allowed them to repeatedly claim LFI tokens.

As a result of this exploit, approximately 1,500,000 $LFI tokens were stolen which is equivalent to around 36,362 $USD at current market value. After stealing these tokens from multiple users' wallets on the Polygon network using this method they swapped them for around 20 $ETH and transferred it to their initial address.

Attacker Address:

https://polygonscan.com/address/0x11576cb3…84a8de

Malicious Transaction:

https://polygonscan.com/tx/0xa0480d0f…266243

Malicious Contract Address:

https://polygonscan.com/address/0x43623b96…e58164