What happened
The attacker's address:
https://bscscan.com/address/0x731821d1…917689
The contract used for the attack:
https://bscscan.com/address/0xa5312796…708e71
The attacker:
- took a 53.25 BTC flash loan from Cream Finance
- used 53.25 BTC to get a 2,717,107 TUSD loan from Venus
- manipulated the price of BNB/TUSD Pool on PancakeSwap
- used 50 different contracts, deployed earlier to deposit 38,250 TUSD into HUNNY TUSD Vault
- redeemed 2842.16TUSD and minted 12,020.40 Hunny
- sold minted Hunny for 7.78 WBNB
-repeated with 50 wallets 26 times.
The hack is made possible by a profit inflation flaw that transforms a little number of harvested ALPACA into a big sum of TUSD for staking. These converted TUSDs are then counted as profit, which is subsequently inflated to produce a big quantity of HUNNY.
Stolen funds were bridged on Ethereum blockchain and deposited into Tornado Cash mixer:
https://etherscan.io/address/0x731821d1…917689
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Post-mortem medium.com
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.