What happened
On 10 December 2022, Mu Bank, the bonding contract behind Mu Coin (MU) and Mu Gold (MUG) on Avalanche, was drained in a flash-loan price manipulation attack. Mu Bank sold MU and MUG "bonds" for USDC.e at a price read directly from Trader Joe liquidity pool reserves. An attacker pushed that pool price down within a single transaction and bought about 99,102 MU and 9,640 MUG for roughly 10,290 USDC.e. The project says this came to about 100,000 MU and 10,000 MUG taken from the bank.
After repaying the flash loan, the attacker kept about 57,659 USDC. They swapped it to about 45.1 ETH and laundered it through cBridge and Tornado Cash. MU and MUG both fell more than 80%.
How it happened
- The attacker flash-borrowed about 578,987 MU from the Trader Joe MUG-MU pair.
- They sold about 578,000 MU for about 85,000 USDC.e on the MU-USDC.e pool, crashing MU's spot price there.
- Mu Bank priced bonds from those same pool reserves via router queries, so the crashed price meant far more tokens per dollar.
mu_bond()turned 3,300 USDC.e into about 99,102 MU, andmu_gold_bond()turned 6,990 USDC.e into about 9,640 MUG. CertiK estimates this was about 30x the normal amount. - The attacker used the remaining USDC.e to buy back MU, repaid the flash loan, and sold the MUG through MUG to MU to USDC.e.
- Net profit was about 57,659 USDC. It was swapped to about 45.1 ETH and moved through cBridge to Tornado Cash.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
