PancakeHunny Hack

The attacker's address:

Address 0x7318…7689

The contract used for the attack:

Address 0xa531…8e71

The attacker:

• Took a 53.25 BTC flash loan from Cream Finance
• Used 53.25 BTC to get a 2,717,107 TUSD loan from Venus
• Manipulated the price of BNB/TUSD Pool on PancakeSwap
• Used 50 different contracts, deployed earlier to deposit 38,250 TUSD into HUNNY TUSD Vault
• Redeemed 2842.16TUSD and minted 12,020.40 Hunny
• Sold minted Hunny for 7.78 WBNB

-repeated with 50 wallets 26 times.

The hack is made possible by a profit inflation flaw that transforms a little number of harvested ALPACA into a big sum of TUSD for staking. These converted TUSDs are then counted as profit, which is subsequently inflated to produce a big quantity of HUNNY.

Stolen funds were bridged on Ethereum blockchain and deposited into Tornado Cash mixer:

Address 0x7318…7689