Novo Hack

A flashloan attack was carried out on the Nova project during which the attacker managed to withdraw 278 $BNB from the protocol.

Novo is decentralized and deflationary volume-based cryptocurrency protocol available on the Binance Smart Chain based on the $NOVO token.

The attacker created a one-time wallet (attacker address (A)) that was used to attack $NOVO. Using this wallet, attacker created a smart contract, which was not verified, in order to make an attack on the token:

1. Tx
2. Tx

In the same transactions, the profit received was sent to the scammer address (B). Then all the remaining profits were sent directly to the scammer address (B):

https://bscscan.com/tx/0x21bbfa5c…a0867d

All the profit was laundered via Tornado.Cash.

Involved addresses:

0x81d3ec77438b4e99aa99ba25b1dbc3fea317fe3b0x81d3ec77438b4e99aa99ba25b1dbc3fea317fe3b

- Attacker address (A): https://bscscan.com/address/0x31A7CC04…29186E

- Attacker address (B): https://bscscan.com/address/0x03765646…7b524b

Smart contracts:

Attacker contract: https://bscscan.com/address/0x3463A663…18cf2a

Victim contract (NOVO token): https://bscscan.com/address/0x6fb2020c…253333